You can't downgrade a modern browser to ssl 3 (the most recent version supported by IE3) because modern browsers dont support sslv3 (prior to dropping support there were also some fixes for downgrade attacks).
Dont get me wrong, supporting sslv3 is still a terrible idea.
It would be interesting to know though what the most secure possible setup is for servers supporting ie3, both when a modern browser connects and when connecting to ie3, and what the security properties are. I would guess that its at least secure against passive monitoring (e.g. a mass survelience situation), which is a pretty low bar, but also the bar a lot of people care about.
> I would guess that its at least secure against passive monitoring
It isn't. IE3 used 40-bit encryption by default, which is trivially brute-forceable with modern hardware. Some versions supported 128-bit ciphers, but only through an unusual upgrade process [1] which depended upon "Global Server ID" SSL certificates with special extensions which are no longer issued.
Even if it weren't for that, it's no longer possible to issue a certificate that would be recognized by IE3. All newly issued SSL certificates are required to be signed with SHA256, which wasn't even published until 2001. (The final release of IE3 was in 1997.)
Is what you say still true if you also want to support IE4, 5, 6, 7, etc? You'd want functionality for all the browsers, and strong privacy for the latest versions of browsers.
I assume if you're supporting ie3 you also want to support every newer version.
You are correct, I support every known browser, and I test with every browser I can get my hands on.
It doesn't mean every single browser will work, but with each tested browser, the chances of that increase.
I consider all our communications to be monitored, and put accessibility above so-called privacy.
Anyway, I don't believe SSL provides privacy in any reasonable way except against the most basic of attackers.
For text-based websites which only provide information for reading and do not deal in commerce, I think making SSL optional is perfectly reasonable, and our SSL obsession has hurt us tremendously in accessibility, while adding a huge attack layer and obfuscating our own communications from ourselves.
Dont get me wrong, supporting sslv3 is still a terrible idea.
It would be interesting to know though what the most secure possible setup is for servers supporting ie3, both when a modern browser connects and when connecting to ie3, and what the security properties are. I would guess that its at least secure against passive monitoring (e.g. a mass survelience situation), which is a pretty low bar, but also the bar a lot of people care about.