5 ms·

(A) A significant percentage of users with legacy browsers could upgrade (by installing Chrome or Firefox, instead of relying on a woefully out of date bundled

(A) A significant percentage of users with legacy browsers could upgrade (by installing Chrome or Firefox, instead of relying on a woefully out of date bundled browser). If much of the internet stops working for them, I imagine knowledge of how to get it working again will spread pretty quickly. (B) It seems incredibly difficult (impossible?) to support graceful downgrade to older insecure approaches to TLS without also introducing the opportunity for a downgrade attack. Many of the TLS attacks we've witnessed over the last few years seem to be the direct result of bending over backwards to maintain backwards compatibility. I'm unconvinced it can be done safely.

eastdakota 11y ago
(A) If you've ever traveled across rural Africa or rural China or rural India and seen how many people access the Internet over original Android (if they're lucky) or Candy Bar Phones (if they're not) you'd realize the folly of your argument. (B) If someone can find a vulnerability to our implementation that we cannot fix then we'll drop support for SHA1 fallback. We'll also allow customers to turn off SHA1 fallback if they'd prefer. But that should be the choice of a site on a site-by-site basis, not imposed by the browser vendors.
- qb45 11y ago
  You may not even need to travel to the third world. Just wait until all those "smart" cars, refrigerators, etc. with "secure" (i.e. not user tamperable) update mechanisms come out of warranty.
  - eliaspro 11y ago
    As if they shipped updates to these devices within the warranty period in the first place.
ploxiln 11y ago
Amusingly, these users may not be able to download modern browsers from the official websites, which will of course be only available over TLS for obvious security reasons ...
- biot 11y ago
  You mean as the article explicitly points out with "Mozilla's one million downloads mistake"? I'm not sure how that could be considered amusing.
  - ploxiln 11y ago
    Unintended consequences. Unfortunate. But after you've seen enough of them, funny as well.
- brohee 11y ago
  Windows installers can and should be signed, since at least Wondows XP, so it can be safe to download a browser over an unencrypted connection...

eastdakota 11y ago

(A) If you've ever traveled across rural Africa or rural China or rural India and seen how many people access the Internet over original Android (if they're lucky) or Candy Bar Phones (if they're not) you'd realize the folly of your argument. (B) If someone can find a vulnerability to our implementation that we cannot fix then we'll drop support for SHA1 fallback. We'll also allow customers to turn off SHA1 fallback if they'd prefer. But that should be the choice of a site on a site-by-site basis, not imposed by the browser vendors.

qb45 11y ago
You may not even need to travel to the third world. Just wait until all those "smart" cars, refrigerators, etc. with "secure" (i.e. not user tamperable) update mechanisms come out of warranty.
- eliaspro 11y ago
  As if they shipped updates to these devices within the warranty period in the first place.

ploxiln 11y ago

Amusingly, these users may not be able to download modern browsers from the official websites, which will of course be only available over TLS for obvious security reasons ...

biot 11y ago
You mean as the article explicitly points out with "Mozilla's one million downloads mistake"? I'm not sure how that could be considered amusing.
- ploxiln 11y ago
  Unintended consequences. Unfortunate. But after you've seen enough of them, funny as well.
brohee 11y ago
Windows installers can and should be signed, since at least Wondows XP, so it can be safe to download a browser over an unencrypted connection...