In fact, the use of TLS 1.0 should not be seen as a threat to the Site itself (Server) most of the time. It should be seen as a threat to the client. I want to explain the reason for this to you with a simple scenario.
(By the way, this is the communication diagram so that you can visualize it in your mind.)
Scenario: For example, you are a person who had to create a home office during the pandemic period, that is, had to work from home, and you work through the management panel on your institution's website, which uses TLS 1.2 (Actually, the last TLS version is 1.3, but the most popular version is 1.2) technology. Fortunately, while you are working, a spy connects to your Wi-Fi and monitors your network, that is, performs packet sniffing (Man in the middle performs the attack we call). While monitoring your network, it can see the connection you make with the system you are working on, but since the technology we call TLS (Transport Layer Security) is used, the packets you send to the server and the packets coming to you from the server are encrypted and fall in front of the attacker. Since the attacker corporate website uses TLS 1.2, unfortunately it cannot decode the encrypted package and your data sent on the package, such as the cookie of your account you use within the institution, is protected by TLS 1.2. "BUT" if the institution had used TLS 1.0 technology. Since it was easier, even very easy, to decode compared to 1.2, your cookies, etc. data could easily be accessed and your critical information could be stolen directly over the network you use. (For example, TLS technology is not used on sites that do not redirect to HTTPS addresses, and when the network is listened to during your communication with these sites, the packets you send and receive are obvious and presented to the attacker on a silver platter.)
Friends, the bottom line is that vulnerabilities in TLS technology often pose a threat to the site user. You cannot gain unauthorized access to web systems over TLS. Thanks for reading (The topic is the continuation of About TLS 1.0 written by P30w4ll. If you haven't read it, I definitely recommend you to read it.)
So, if you say, I will exploit these TLS 1.0-related vulnerabilities, get an RPI, get a good Ethernet card, go door to door and monitor the people's network.
