:ssl has improved a bit: it removed support for SSL 3.0, it added TLS 1.3 (still a bit flaky) along with some new ciphers/curves, and better handling of out-of-order certificates coming from the server. But what hasn’t changed is the default of verify: :verify_none, both for :ssl.connect/2,3,4 and the :httpc application.
HTTPotion seems to be ‘soft deprecated’.
Hackney has had a few issues lately due to :ssl changes. Sometimes it was possible to work around them, until a new version would land, by passing custom ssl options. The major catch there is that any custom ssl options passed to Hackney (and therefore HTTPoison and Tesla) will overwrite the secure defaults. So passing something like ssl: [versions: [:tlsv1_2]] reverts the :verify option back to :verify_none!
Mint attempts to merge custom ssl options with its own secure defaults (which is not trivial to do, since the individual options are inter-dependent). Any libraries that build on Mint should be fine too.
You can consider my ElixirConf EU 2019 talk ‘Learn you some :ssl for much security’ to be an updated version of the blog post referenced earlier in this thread. It is already a year old, but still mostly relevant.
