28

tl;dr: As early as September 9th, some users accessing the site from old Android devices (running Android 7.0 and earlier) may see SSL warnings in their browser regarding an invalid certificate when they attempt to access the site.

The technology that allows Stack Exchange to serve traffic to users securely is called "SSL." To serve traffic via SSL, Stack Exchange needs to be issued a “security certificate” from a trusted provider. Our certificate is issued by Let’s Encrypt, one of the largest and most trusted security certificate providers on the web.

Without getting into technical details (which you may read on Let’s Encrypt’s site), Let’s Encrypt is making a change to how they operate their security certificates. This change will cause certain older devices, including most Android devices issued 2017 and earlier, to no longer trust traffic using Let’s Encrypt’s certificates.

Because Stack Exchange uses Let’s Encrypt, as early as September 9th, we expect that some users of Stack Exchange will see SSL warnings about an invalid certificate when they attempt to access the site. We estimate that 0.07% of traffic to the site will be affected by this change.

If you believe you will be affected by the change, or want to understand the technical details of the change, we encourage you to read Let’s Encrypt’s post on the topic. They offer an explanation as to what is changing and how users may be able to work around the issue.

Improve this question
22
  • 9
    Security Certificates: forcing the Internet to upgrade since 1995 (when SSL2 died a fiery death)
    – Machavity
    Commented Sep 5 at 17:48
  • 1
    Why do you need to estimate? Browsers also send OS info, and you're using Google Analytics so the percentage should be known.
    – Shadow Wizard
    Commented Sep 5 at 20:05
  • 10
    @ShadowWizard I don't tend to say a number is exact unless I am very sure it is verifiably exact. There are sources of error in virtually all measurements regarding web traffic. But for clarity's sake, I expect that 0.07% estimate to be very precise.
    – Slate StaffMod
    Commented Sep 5 at 20:16
  • 1
    @Shadow Well I also took “will be affected” as predicting the future. As in, “in the past, we’ve observed 0.07% of our traffic is using this old browser/OS combo, but we can only estimate that that will continue.” In fact I would expect it to gradually decline (and not have been a constant 0.07% across all of time, either) as people finally get their wits about them and upgrade, lose or drown their phones and replace them, etc. So I guess it all depends on what you’re estimating, unless you’re also time traveling.
    – user1502910
    Commented Sep 5 at 20:24
  • 2
    Maybe related (as some history): Invalid certificate on all SE sites. Also, maybe related on Android.SE: Let's Encrypt: Is there a workaround for the 2021 SSL "cutoff" for pre-7.1.1 Android devices?
    – Meta Andrew T.
    Commented Sep 6 at 2:04
  • 1
    I suspect it's the exact same situation. Also there's going to be invariably a few folks deeply invested in not upgrading for all sorts of reasons 😅
    – Journeyman Geek
    Commented Sep 6 at 2:18
  • 1
    An unfortunate consequence of this is that people who can't afford new devices (or who do not want to contribute to eWaste) will now be less likely to use Stack Exchange sites. People who cannot afford expensive universities are the exact people that likely benefit from Stack Exchange the most. It will be interesting to see if people choose to stop using Stack Exchange or if they choose to ignore the important security warnings. Will Stack Exchange be tracking that data?
    – Amazon Dies In Darkness
    Commented Sep 6 at 3:03
  • @EndAntisemiticHate Well, I don’t know how (and maybe I don’t want to think about how) they could possibly track people who stop coming for that reason. However those people you’re concerned about are going to face this issue across a lot of the Internet, not just here. I suspect many sites won’t provide this type of heads-up.
    – user1502910
    Commented Sep 6 at 4:22
  • @testing-for-ya I haven't spent much time thinking about the mechanism(s) to track it, but here's a little brainstorming: Right now about 0.7% of traffic comes from such users. So we know those connections can be measured. It may be as simple as measuring the traffic from such users every week/month in the future. Or it may involve monitoring the number of HTTP connections. Or it may be possible to monitor the number of HTTPS connections with non-validated TLS certificates. Or perhaps a combination of those techniques with other techniques.
    – Amazon Dies In Darkness
    Commented Sep 6 at 5:49
  • @EndAntisemiticHate It’s 0.07, not 0.7. But anyway, my point was not that they can’t continue monitoring the traffic; they obviously can. But just like all the recent hoopla about ChatGPT, if the traffic changes, you still can’t know why. It is just as likely they’ve “left” for the reasons I suggested as for the big scary banner they’re probably seeing in a lot of other places, too. In any case, let’s say they do observe a dip in traffic for these users on ancient devices. Let’s say the traffic dips to 0.05% or 0.02%, and that you “know” why. What then? What would you want SE to do about it?
    – user1502910
    Commented Sep 6 at 10:36
  • 2
    @EndAntisemiticHate If I'm understanding your question correctly, I don't think we're going to be tracking that. Since it represents a small segment of users, and it's not really something we can fix, not too much point putting work into measuring this change in a detailed manner. It's also such a small segment of users that it's probably too noisy to meaningfully determine change.
    – Slate StaffMod
    Commented Sep 6 at 14:10
  • 1
    @testing-for-ya but looks like hundreds of new smartphones are still being sold with Android 7, so even if people will decide to "upgrade" old device they lost or drowned, they might get a new device with ancient OS.
    – Shadow Wizard
    Commented Sep 6 at 14:25
  • 1
    @ShadowWizard Maybe so. I still don't know what people here are expecting SE to do about that.
    – user1502910
    Commented Sep 6 at 14:27
  • 1
    @EndAntisemiticHate: You are correct, they will be less likely to use SE, but they will be fine if they start using Firefox Mobile as recommended in the Let's Encrypt article. And since many websites use certificates from Let's Encrypt, they'll almost be forced to install Firefox Mobile anyway, at which point they access SE sites without a problem.
    – President James K. Polk
    Commented Sep 6 at 20:21
  • 1
    @testing-for-ya I don't expect SE to do anything, just trying to make a point that even though 0.07% looks minor, it still means lots of people, and since new devices still being sold with Android 7, it won't go away any time soon. (And also making "accessing the site from old Android devices" not very accurate.)
    – Shadow Wizard
    Commented Sep 7 at 8:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .