How to weigh risks of an old iPhone and invalid site certificates

Q: The iPhone 7 will not be supported after the fall iOS update. I have a perfectly functional iPhone 7 with over 90% battery life left. I don’t care about getting new features, but I would like to continue to use it and keep it safe after Apple stops support. Is there any software I can run, or any other way to get security updates? Or is this phone going to become too unsafe to use?

— Kenneth Danis

A: You’re right that you won’t be able to install the latest version of the iPhone operating system — iOS 16 — on your iPhone 7.

But so far, at least, Apple is still supporting iOS 15 with updates. It released iOS 15.7 on Sept. 12 that fixes a number of vulnerabilities. I could not find any indication from Apple about whether it will continue to deliver updates to iOS 15.

Once Apple stops providing security updates, you may want to consider moving to another phone. Your phone will continue to work, but it will be increasingly vulnerable.

That said, security is a relative thing. Vulnerabilities are regularly discovered in all operating systems. So compare the risk of using a device that runs an operating system that is no longer supported to using a device that is running a currently supported operating system, but that is likely to a more attractive target for hackers.

Q: I have frequently received notices about an “invalid certificate” when visiting a website — even King County government sites. The notice says the website “may be impersonating … to steal personal information.” Further, it warns, “An attacker may have compromised your connection.” There is more detail about “viewing the website.” But, the additional information on the following screens does not offer a step-by-step solution. What’s happening here?

— Mike Kirk, Vashon Island

A: How do you know when you click a link that you’re really connecting to your bank and not on a fraudulent site aimed at collecting your sensitive information? Legitimate website owners pay for “security certificates.” When you access a secure website, the site delivers its security certificate to your browser. If the website certificate is up-to-date and from a trusted certificate authority, you’re allowed to log in and do your transactions. If there’s a mismatch, however, you’ll get that warning.

In my experience, however, that’s no reason to panic. In most cases, the warning is triggered by an out-of-date but otherwise legitimate certificate. But if you’re dealing with finances or other sensitive information, heed the warning and leave the site.

Q: Every now and then, I go to a website and receive a partial page. A refresh usually fixes the problem. When it doesn’t, which is rare, a second refresh works. Admittedly, this is a relatively trivial problem to solve, but do you have any advice for a solution? 

— Phil Dawson

A: The first thing I do when encountering unexpected website behavior is to try a different browser. If the problem disappears, the cause is almost certainly one of two things in the misbehaving browser: the browser’s cache needs to be cleared, or a browser extension is interfering. After you’ve cleared the cache, if the problem still recurs, you can find the cause by disabling all extensions and adding them back one at a time until the problem recurs.

But if the problem also occurs using a different browser, my suspicion would turn to an overloading of your internet connection. Reboot your internet hardware, including any modems and Wi-Fi routers. Ensure that no unauthorized users are accessing your internet service. Consult the documentation for those modems and routers to learn how to monitor connections. And, of course, you want to ensure that access to your Wi-Fi is secure.