4 ms·

> Bug 11154: Disable TLS 1.0 (and 1.1) by default I'm still a little shocked by this. It's 2020 and we were still allowing these old protocols?

by als0 6y ago

throw0101a 6y ago
For general day-to-day browser of random websites for amusement, is there a particular reason why we should care? I'm not against more crypto generally to help reduce mass surveillance, but how many Wix / Square Space / free WP/Blogspot sites actually need to have TLS 1.2+?
- snazz 6y ago
  If anything, websites made with drag-and-drop website builders should always use the latest TLS standard because it’s just a single change for the hosting provider to make for all of the customers. I think the hosting provider generates a certificate anyway.
- peteretep 6y ago
  My understanding is that the general argument is that if we all require security for comedy browsing, the traffic of the people who require better security is better because it’s less conspicuous? See also declaring your personal pronouns as someone who thinks they will never be misgendered, or using Tor for normal browsing
  - throw0101a 6y ago
    As I stated: I'm not against crypto in general (even for "comedy browsing") as it helps against mass surveillance. I'm just not sure as to what disabling 1.0 in the browser does. People who really care can enable 1.2+ on their servers and the browser will use it, but someone who just has a site up 'for fun' could be cut off. In some ways it motivates people to not even bother with HTTPS because it now because higher maintenance to keep up with all the settings. This could actually encourage just leaving HTTP, which could be worse.
- abdullahkhalids 6y ago
  The reason is that encrypted websites are a bit harder to hack and inject malicious code into. In particular MITM attacks are much harder to pull off - such as those by airport/mall free wifis. Using the latest version of TLS makes us safe from hacking.
  - throw0101a 6y ago
    Using TLS in general, regardless of version, makes us safe(r) from hacking as it prevent injection. What how does disabling 1.0 specifically do?
    - abdullahkhalids 6y ago
      Good question. Because it is an old protocol, vulnerabilities have been discovered in it over time [1]. Got to keep things updated! [1] https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/ https://www.acunetix.com/blog/articles/tls-vulnerabilities-a...
    - tialaramex 6y ago
      The RFC that tells people who weren't paying attention to stop using TLS 1.0 and TLS 1.1 will explain this, here's the current draft of that document: https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-06 https://tools.ietf.org/html/draft-ietf-tls-oldversions-depre... Examples of things mentioned: SHA-1 sucks, this hash is too short by modern standards and we know it's flawed even though collision (the exciting headline making flaw) isn't especially relevant to TLS. But in TLS 1.0 SHA-1 is either the only hash permitted (in some places) or it's the best option left (MD5 is allowed but that's worse). TLS 1.0 doesn't explain the necessity of guarding against padding oracles or how to do so. Now, of course it also doesn't ban you from guarding against them. But wait, if you're going back to upgrade your software to mitigate padding oracle attacks on TLS 1.0 why aren't you just upgrading to TLS 1.2 ? The stacks we're confident have effective mitigations all... offer TLS 1.2 anyway. TLS 1.0 specifically requires you can do 3DES (in the terminology it's "Mandatory to implement" or MTI). But 3DES sucks, it's very slow and not as secure as a modern cipher. So you would never want to actually use 3DES, but it's mandatory in TLS 1.0 so now you're implementing a cipher that's very bad and you never want to use, just so you can support an obsolete protocol version. Or we can deprecate that protocol version and tell people to just use a newer protocol.
- deleted 6y ago
  [deleted]
- tialaramex 6y ago
  Obviously your web browser doesn't know if this is "just" some Wix brochureware site where you don't actually care about security or if it's a bank or your webmail or the passport office. So to keep browser users safe we need to deliver the security they expect all the time. The rule has to be consistent, either the rule is "TLS 1.0 is no good, stop that" or it's "TLS 1.0 is fine, First Bank of Springfield can keep right on using it". There's not really space for nuance here because there's no sign of a capacity for nuance in the ordinary user's understanding of web security. If anything the continued existence of plaintext HTTP is already too much nuance for users, but unlike adding a special "Kinda sorta secure" TLS 1.0 mezzanine that's a legacy problem we're stuck with already.
  - throw0101a 6y ago
    Well that's fine, but banks and Gmail (and even Wix sites) will advertise TLS 1.2+ and be just dandy as the web browser will choose the latest and greatest. But what harm does allowing 1.0 if you want to read a static HTML web page from 2001 about the Cowboy Bebop anime series?
    - schoen 6y ago
      The idea is that the browser doesn't know whether you're accessing the static HTML page or a bank that failed to upgrade.
est31 6y ago
The plan was actually to deprecate support this year (only <2% of websites support TLS < 1.2 as highest version), but then COVID-19 came and apparently many health related government websites use those old TLS versions :/, so they dropped their plans. https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/ https://nakedsecurity.sophos.com/2020/04/02/covid-19-forces-browser-makers-to-continue-supporting-tls-1-0/ https://nakedsecurity.sophos.com/2020/04/02/covid-19-forces-...
codegeek 6y ago
I don't disagree with you but you will be more shocked to know that there are plenty of webhosts that are running old outdated websites/web applications and will fail in TLS 1.2. That is not an excuse but still a reality.
pezezin 6y ago
I'm working for a big international project and our most important website is running fucking SSL 3.0 I reported it one year ago, and it hasn't been fixed yet. Many people are having problems connecting now, because browsers are removing support. The server is hosted in Germany, which really amuses me given their reputation for good engineering...
- jFriedensreich 6y ago
  That reputation comes from cars and machines, not from software. Germany is one of the worst places for anything digital.
  - ascar 6y ago
    That's unfortunately so true. The thorough and strongly regulated engineering results in good quality for mechanical products, but is detrimental for the fast paced software world. SSL3.0 is from 1996. That's the life cycle of 2-3 cars and much less than a building, so "not a long time ago" in engineering terms "when it still works". I joined a German engineering company and made the naive assumption that proficiency in engineering is correlated to proficiency in software engineering. I will not make that mistake again. The reality is that the classical engineering disciplines (mechanical, civil, etc.) and software engineering are very different in practice. While waterfall/V model is discouraged in software, it's a very valid approach for physical goods with high iteration costs and nearly no option of upgrade after sale.
    - kspacewalk2 6y ago
      Having to deal with Siemens healthcare software - they take the very understandable risk aversion (some of which is a must when it comes to medical equipment) and take it so far that it seriously hampers their ability to keep up with the industry, and (ironically) to maintain a stable product. I think it's their North American software teams that keep them moving forward, otherwise they'd still to this day be selling new MR and CT scanners running Windows XP. And we all know the problem with technical debt - it's not a problem until one day it's a huge fucking problem that paralyzes you and forces you to stop moving forward at all for some time, just so you can pay off the debt.

> Bug 11154: Disable TLS 1.0 (and 1.1) by default I'm still a little shocked by this. It's 2020 and we were still allowing these old protocols?

by als0 6y ago

> Bug 11154: Disable TLS 1.0 (and 1.1) by default I'm still a little shocked by this. It's 2020 and we were still allowing these old protocols?

throw0101a 6y ago

For general day-to-day browser of random websites for amusement, is there a particular reason why we should care? I'm not against more crypto generally to help reduce mass surveillance, but how many Wix / Square Space / free WP/Blogspot sites actually need to have TLS 1.2+?

snazz 6y ago
If anything, websites made with drag-and-drop website builders should always use the latest TLS standard because it’s just a single change for the hosting provider to make for all of the customers. I think the hosting provider generates a certificate anyway.
peteretep 6y ago
My understanding is that the general argument is that if we all require security for comedy browsing, the traffic of the people who require better security is better because it’s less conspicuous? See also declaring your personal pronouns as someone who thinks they will never be misgendered, or using Tor for normal browsing
- throw0101a 6y ago
  As I stated: I'm not against crypto in general (even for "comedy browsing") as it helps against mass surveillance. I'm just not sure as to what disabling 1.0 in the browser does. People who really care can enable 1.2+ on their servers and the browser will use it, but someone who just has a site up 'for fun' could be cut off. In some ways it motivates people to not even bother with HTTPS because it now because higher maintenance to keep up with all the settings. This could actually encourage just leaving HTTP, which could be worse.
abdullahkhalids 6y ago
The reason is that encrypted websites are a bit harder to hack and inject malicious code into. In particular MITM attacks are much harder to pull off - such as those by airport/mall free wifis. Using the latest version of TLS makes us safe from hacking.
- throw0101a 6y ago
  Using TLS in general, regardless of version, makes us safe(r) from hacking as it prevent injection. What how does disabling 1.0 specifically do?
  - abdullahkhalids 6y ago
    Good question. Because it is an old protocol, vulnerabilities have been discovered in it over time [1]. Got to keep things updated! [1] https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/ https://www.acunetix.com/blog/articles/tls-vulnerabilities-a...
  - tialaramex 6y ago
    The RFC that tells people who weren't paying attention to stop using TLS 1.0 and TLS 1.1 will explain this, here's the current draft of that document: https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-06 https://tools.ietf.org/html/draft-ietf-tls-oldversions-depre... Examples of things mentioned: SHA-1 sucks, this hash is too short by modern standards and we know it's flawed even though collision (the exciting headline making flaw) isn't especially relevant to TLS. But in TLS 1.0 SHA-1 is either the only hash permitted (in some places) or it's the best option left (MD5 is allowed but that's worse). TLS 1.0 doesn't explain the necessity of guarding against padding oracles or how to do so. Now, of course it also doesn't ban you from guarding against them. But wait, if you're going back to upgrade your software to mitigate padding oracle attacks on TLS 1.0 why aren't you just upgrading to TLS 1.2 ? The stacks we're confident have effective mitigations all... offer TLS 1.2 anyway. TLS 1.0 specifically requires you can do 3DES (in the terminology it's "Mandatory to implement" or MTI). But 3DES sucks, it's very slow and not as secure as a modern cipher. So you would never want to actually use 3DES, but it's mandatory in TLS 1.0 so now you're implementing a cipher that's very bad and you never want to use, just so you can support an obsolete protocol version. Or we can deprecate that protocol version and tell people to just use a newer protocol.
deleted 6y ago
[deleted]
tialaramex 6y ago
Obviously your web browser doesn't know if this is "just" some Wix brochureware site where you don't actually care about security or if it's a bank or your webmail or the passport office. So to keep browser users safe we need to deliver the security they expect all the time. The rule has to be consistent, either the rule is "TLS 1.0 is no good, stop that" or it's "TLS 1.0 is fine, First Bank of Springfield can keep right on using it". There's not really space for nuance here because there's no sign of a capacity for nuance in the ordinary user's understanding of web security. If anything the continued existence of plaintext HTTP is already too much nuance for users, but unlike adding a special "Kinda sorta secure" TLS 1.0 mezzanine that's a legacy problem we're stuck with already.
- throw0101a 6y ago
  Well that's fine, but banks and Gmail (and even Wix sites) will advertise TLS 1.2+ and be just dandy as the web browser will choose the latest and greatest. But what harm does allowing 1.0 if you want to read a static HTML web page from 2001 about the Cowboy Bebop anime series?
  - schoen 6y ago
    The idea is that the browser doesn't know whether you're accessing the static HTML page or a bank that failed to upgrade.

est31 6y ago

The plan was actually to deprecate support this year (only <2% of websites support TLS < 1.2 as highest version), but then COVID-19 came and apparently many health related government websites use those old TLS versions :/, so they dropped their plans. https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/ https://nakedsecurity.sophos.com/2020/04/02/covid-19-forces-browser-makers-to-continue-supporting-tls-1-0/ https://nakedsecurity.sophos.com/2020/04/02/covid-19-forces-...

codegeek 6y ago

I don't disagree with you but you will be more shocked to know that there are plenty of webhosts that are running old outdated websites/web applications and will fail in TLS 1.2. That is not an excuse but still a reality.

pezezin 6y ago

I'm working for a big international project and our most important website is running fucking SSL 3.0 I reported it one year ago, and it hasn't been fixed yet. Many people are having problems connecting now, because browsers are removing support. The server is hosted in Germany, which really amuses me given their reputation for good engineering...

jFriedensreich 6y ago
That reputation comes from cars and machines, not from software. Germany is one of the worst places for anything digital.
- ascar 6y ago
  That's unfortunately so true. The thorough and strongly regulated engineering results in good quality for mechanical products, but is detrimental for the fast paced software world. SSL3.0 is from 1996. That's the life cycle of 2-3 cars and much less than a building, so "not a long time ago" in engineering terms "when it still works". I joined a German engineering company and made the naive assumption that proficiency in engineering is correlated to proficiency in software engineering. I will not make that mistake again. The reality is that the classical engineering disciplines (mechanical, civil, etc.) and software engineering are very different in practice. While waterfall/V model is discouraged in software, it's a very valid approach for physical goods with high iteration costs and nearly no option of upgrade after sale.
  - kspacewalk2 6y ago
    Having to deal with Siemens healthcare software - they take the very understandable risk aversion (some of which is a must when it comes to medical equipment) and take it so far that it seriously hampers their ability to keep up with the industry, and (ironically) to maintain a stable product. I think it's their North American software teams that keep them moving forward, otherwise they'd still to this day be selling new MR and CT scanners running Windows XP. And we all know the problem with technical debt - it's not a problem until one day it's a huge fucking problem that paralyzes you and forces you to stop moving forward at all for some time, just so you can pay off the debt.