[External] jetty

[Matthew Slowe]

> On 18 Mar 2021, at 16:47, Ian Young <ian at iay.org.uk> wrote:
> 
> If you want better than B, that implies that you're giving up 1.6% of browser clients (worldwide, of all types). Interestingly, that seems to be only 0.23% of mobile browsers, it's the desktop ones from 2013 and earlier that cause the problem. Of course numbers like that are only meaningful if you know whether their sample is representative of your clients.

On the other hand, do you want to actively make security-related compromises for legacy (read as "unsupported" or "unsupportable") clients? If the device is only capable of using protocols/ciphers etc that can be compromised then do you want them exchanging (high-value?) credentials with your authentication services over the big-bad-internet?

It's a user-experience/risk/security balance that can be hard to get right!

I would echo your ">= B" and testssl/ssllabs :-)

-- 
Matthew Slowe (GPG: 0x6BE0CF7D04600314)
Senior Technical Consultant and Support specialist - Trust & Identity, Jisc
Team: 0300 300 2212, option 2
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG