XP support was dropped by MS on April 8 2014, almost two years ago, but there are still many people who use XP for internet surfing.
Also, there are still many sites like Google or Facebook who offer SSLv3 and similar stuff to support XP. However, if we would drop XP we would have a much better security. We could use:
- SHA2 certs (well yeah, XPSP3 fixed theat one, but too many XP users still have SP2)
- SNI, probably one of the most important aspects of shared HTTPS hosting.
We have a pretty similar situation with older Android (<4.0) but unlike for XP we have actual numbers of the active androids in the Internet by Google and their number is just 3.2%, where we could almost ignore them.
And the most significant point is that everyone who really wants to be on this old system can use Firefox which offers all the nice Security features, and still does XP and most old Android versions (Froyo is an exception).
So let's get to the point:
In light of all that, is it already "safe" to drop XP support (and old Android along with it) from HTTPS sites to give better security? Especially seeing that browser vendors are going to mark even more vulnerabilities out day by day. Should we wait, and if yes, until when?