Answers to Why is HTTPS not the default protocol? state that a lot of sites still use clear HTTP instead of HTTPS because all of these are true:
- A substantial number of visitors to the site use Internet Explorer 6, 7, or 8 for Windows XP (IE/XP).
- IE/XP can see only the first certificate on port 443 of a given IP address because it uses Windows XP's TLS library, which lacks support for Server Name Indication (SNI). (Chrome and Firefox on Windows XP use different TLS libraries that support SNI.)
- The site shares an IPv4 address with another HTTPS site because it can't afford an increasingly scarce dedicated IPv4 address.
However, as of April 2014, extended support for IE/XP and the rest of Windows XP has ended. This means there are defects in IE/XP that Microsoft will no longer fix. A malicious actor could install unwanted software by exploiting a zero-day vulnerability resulting from one of these defects, which would defeat the confidentiality purpose of HTTPS in either of two ways:
- A keylogger could capture all payment credentials, such as credit card numbers and Amazon or PayPal passwords, that an IE/XP user enters into HTTPS sites.
- A proxy and certificate authority running on the local machine could perform a man-in-the-middle (MITM) attack on all the user's HTTPS connections.
What factors should a website's operator weigh when determining whether to continue to attempt to serve secure pages to IE/XP users? Are there any overwhelming arguments as of the first quarter of 2015 for accommodating or blocking IE/XP on a secure site?