3 ms·
The real issue with deprecating TLS 1.0 and CBC ciphers is that you need a minimum of Android 4.4 for TLS 1.2. Might not be reflected in browsing stats, but ac
by pbarnes_1 8y ago
The real issue with deprecating TLS 1.0 and CBC ciphers is that you need a minimum of Android 4.4 for TLS 1.2.
Might not be reflected in browsing stats, but according to this: https://developer.android.com/about/dashboards/ https://developer.android.com/about/dashboards/ it's 3.8% of Android users. And that number undercounts non-Google Play Services using Android devices.
- dvorak42 8y agoThis particular blog post and plan is regarding removing support of old TLS versions and options on the client. Which means that all server administrators need to do is enable TLS 1.2 and modern options. Old clients (such as Android) will still be fine, if the servers don't also turn off older versions/options.
- tcd 8y agoKikat was released 4 years ago, and Chrome plans to drop Jellyean on Android anyway, and genuinely, is enforcing minimums such a bad idea? When you're handling your own PII and potentially others (contacts, addresses, phone numbers etc) I think having an absolute minimum requirement is beneficial for the Internet as a whole; for example, it'd not be easy to use Windows XP and access the Internet, for good reason, I'd hope (I can't verify that but I doubt browsers still work there). This is good news all around, forcing people to upgrade is a good idea in the long run.