14 ms·
TLS 1.0, 1.1 officially deprecated
- VoidWhisperer 6y agoSome interesting draft names there.. 'draft-moriarty-tls-oldversions-diediedie'
- gsmethells 6y agoAuthors: Kathleen Moriarty, Stephen Farrell It seems it's a last name of an author and not just the arch nemesis of Sherlock Holmes. ;)
- kibwen 6y agoAnd let's not overlook the uncredited contributions from Dieter D. Dietrich.
- LetsNotForget7 6y agoLet's not forget Hiedler 0.1, never forget. Yeah TLS 1.2 is deprecated, let's 1.3 my all co-doggs! TLS 1.2 is shit my dudes. TLS 1.3 or bust.
- cbhl 6y agoAs far as I can tell, the 'diediedie' naming is historical; for example drafts for RFC 8758 Deprecating RC4 in Secure Shell (SSH) were named draft-luis140219-curdle-rc4-die-die-die (https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-18 https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-di...) and similarly for RFC 7568 Deprecating Secure Sockets Layer Version 3.0 which had drafts named draft-ietf-tls-sslv3-diediedie (https://tools.ietf.org/html/draft-ietf-tls-sslv3-diediedie-03 https://tools.ietf.org/html/draft-ietf-tls-sslv3-diediedie-0...). The mailing list archives also say that someone raised a concern at a meeting, which is why the later drafts were named -deprecate. (https://www.mail-archive.com/tls@ietf.org/msg09563.html https://www.mail-archive.com/tls@ietf.org/msg09563.html)
- Mountain_Skies 6y agoI wonder if the origin of diediedie is a geek reference to the Usenet newsgroup alt.wesley.crusher.die.die.die, which was created not long after the premier of Star Trek: The Next Generation in 1987.
- diegocg 6y agoMaybe the IETF could set an example by using TLS 1.3 (Just a suggestion, but hey, at least they use DNSSEC)
- tptacek 6y agoThey're some of the only people that use DNSSEC; DNSSEC is a dead letter. It's useful to compare the uptake of TLS 1.3 (quite widespread; will within a few years be required for conformance; took just a couple years) to that of DNSSEC (it's been decades).
- jeroenhd 6y agoThat depends on the TLD. For the American TLDs (.com, .net, etc.) you're right, there's barely any uptake. Several other TLDs (.cz, .no, .nl, .se, for example) have over half of their registered domains using DNSSEC. That's much more than TLS before the Let's Encrypt move happened. The problem is also with cloud providers. Amazon Route 53, has only announced support a few months ago [1] even though the standard has existed since before Route 53 came into existence. Perhaps it's time for browsers to consider DNSSEC to determine the security of the website, similar to how TLS and CORS have been added to protect web resources. The uptake would improve quickly if people wouldn't be lazy or lackluster about their DNS security. [1]: https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-route-53-support-dnssec/ https://aws.amazon.com/about-aws/whats-new/2020/12/announcin...
- growse 6y agoWhat threats does DNSSEC defend against? How does it change the "security" of a site I might visit?
- 1vuio0pswjnm7 6y agoIf you use third party DNS, e.g., ISP , Google, NextDNS, etc., the third party provide you with access to a DNS cache. The cache is shared with (many, many) other users. If the other users manipulate the data in the cache, or the DNS data in transit from authoritative DNS servers to the cache is manipulated, DNSSEC can help to detect that. It is like downloading a file over an insecure network then checking against known checksums/hashes/fingerprints. Except with DNSSEC the owner of the file does not create the hashes. She delegates control over the signing process to third parties.
- lyeager 6y agoMaybe now it's finally time for Discord to update their auto-updater. Last I checked, you still have to enable TLS 1.1 to get updates. https://twitter.com/discord/status/958508910536790016 https://twitter.com/discord/status/958508910536790016
- ipsocannibal 6y agoAccording to [1] 68% of websites still support TLS 1.0 as of 2019. Unfortunately, the pace of deprecation is slow. 1. https://hostingtribunal.com/blog/ssl-stats/ https://hostingtribunal.com/blog/ssl-stats/
- JshWright 6y agoThere is a difference between "supporting old TLS" and "requiring old TLS". Neither are great, but one is terrible.
- newman314 6y agoIn a similar vein, 2021 is the first time that I've been able to update TurboTax without having to resort to re-enabling TLS 1.0 and 1.1
- ping_pong 6y ago"Deprecate" means "to discourage use of", and it doesn't mean "to end support or to desupport". But it's the most misused word in tech that I've seen in the past 25 years. So I'm not actually sure if this RFC is using it in the correct way, or the incorrect way.
- Bjartr 6y ago> Deprecation of these versions is intended to assist developers as additional justification to no longer support older (D)TLS versions and to migrate to a minimum of (D)TLS 1.2. Seems to me like this document is trying to be a tool for developers to support telling decision makers that using those versions is discouraged.
- tialaramex 6y agoRight. One of the things it does is Update existing RFCs which are otherwise unrelated except that they say you must use TLS (fine) and that TLS 1.0 is Mandatory To Implement. Without this RFC, inevitably a bureaucrat in some organisation is going to argue that the shiny 2021 project to implement Protocol X must offer the horribly obsolete TLS 1.0 or a 3DES ciphersuite because it says so in this document written in 2010 and surely if that wasn't important it wouldn't say that. This RFC means you get to say no, see, that document you're pointing at has been updated by this newer document which says I can use TLS 1.2 and AES-128 instead as I was planning to before this stupid Zoom call I'm in now.
- zokier 6y agohttps://www.merriam-webster.com/dictionary/deprecate https://www.merriam-webster.com/dictionary/deprecate > to withdraw official support for
- bawolff 6y agoIETF is a standards body. It doesn't provide support for implementations so im not sure how it could withdraw what it doesn't provide in the first place. Regardless i think you're splitting hairs in the definition.
- 6y ago
- lazyweb 6y agoOn a related note, thinking of setting my personal site to TLS 1.3 only. It's still allowing for TLS 1.2 with strong chipers, but except for shutting out anyone using older smartphones or operating systems, what's the harm? Could I fall out of favour with Google & co due to compliance reasons? Thinking of SSL scan tools like this one [1] which gave me an "F" for how I configure my SSH servers, only allowing for very modern ciphers and kex without backward compatibility. [1] https://github.com/rbsec/sslscan https://github.com/rbsec/sslscan
- lenish 6y agoRFC7457[1] and Wikipedia[2] offer an overview of many of the attacks on older versions of TLS. Some of those attacks have been mitigated to varying extents in implementations of the affected versions. TLSv1.3 is meant to resolve completely as many of these issues as possible. When using older protocol versions, it can be complicated to validate that the TLS implementation you are using has the necessary mitigations in place. It can be complicated to correctly configure TLS to minimize the effects of known attacks. Doing that properly requires a fair amount of research, threat modelling, and risk assessment both for yourself and on behalf of anyone accessing your website or service. IME, TLSv1.2 is still a big chunk of legitimate web traffic. It has been steadily dropping since standardization, and TLSv1.3 is the majority by a wide margin from what I can see. I wouldn't be surprised to see some websites and services still needing to support it for a couple years more, at least, depending on their target audience. [1] https://tools.ietf.org/html/rfc7457 https://tools.ietf.org/html/rfc7457 [2] https://en.wikipedia.org/wiki/Transport_Layer_Security#Attacks_against_TLS/SSL https://en.wikipedia.org/wiki/Transport_Layer_Security#Attac...
- GoblinSlayer 6y agoMost of those attacks require ssl2 or cooperation from client.
- shaicoleman 6y ago> thinking of setting my personal site to TLS 1.3 only I wouldn't recommend doing that. You might end up blocking users using a proxy (e.g. for privacy reasons), people on corporate networks, people in China [1], and many other non-traditional browsers (e.g. browsers for the blind, game consoles), users on older versions of curl/wget/lynx, older mobile phones, etc. TLS 1.2 when correctly configured is still perfectly fine. And users with modern browsers will connect with TLS 1.3. TLS 1.3 also has protections against downgrade attacks. Another good scanner for SSL is Qualys SSL Server Test [2]. Getting an A+ score there doesn't require disabling TLS 1.2 For secure configuration, you can use Mozilla SSL Configuration Generator [3] 1. https://www.zdnet.com/article/china-is-now-blocking-all-encrypted-https-traffic-using-tls-1-3-and-esni/ https://www.zdnet.com/article/china-is-now-blocking-all-encr... 2. https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ 3. https://ssl-config.mozilla.org/ https://ssl-config.mozilla.org/
- jakub_g 6y agoIf you're interested in real-world SSL/TLS stats (updated monthly): https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/ Feb 2021 data: - 99.3% sites support TLS 1.2 (or better) - 42.9% sites support TLS 1.3 - 0.7% sites support only TLS 1.0
- moviuro 6y agoAnd for the client-side: 90.29% support according to [0] [0] https://caniuse.com/tls1-3 https://caniuse.com/tls1-3
- oaiey 6y agoWhen you are in a browser. API calls are not evergreen as Browsers are.
- croutonwagon 6y agoSame with compiled applications. Windows is the clear laggard here but still https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp- https://docs.microsoft.com/en-us/windows/win32/secauthn/prot... .Net says to use the OS schannel protocols. Even the latest Windows doesnt do TLS 1.3 yet. MSSQL has no support for it either. Even on the end user side. One i like to point out is disable TLS 1.0 and try and launch discord. Their update cdn only supports TLS 1.0. So the application doesnt function unless the OS client also will use TLS 1.0 I opened a ticket with them about it and was marked solved and responded with. >Sadly, this is currently working as intended. However, if you would like to see changes to these systems in the future, then you can definitely vote up the suggestions at feedback.discordapp.com. We are a long way from removing TLS 1.0.
- pitterpatter 6y agoSome details missing on that page: Windows supports TLS 1.3 as of version 1903 [1], just disabled by default. I believe it's enabled by default in insider builds as of this summer. [1] https://devblogs.microsoft.com/premier-developer/microsoft-tls-1-3-support-reference/ https://devblogs.microsoft.com/premier-developer/microsoft-t...
- GeneticGenesis 6y agoI work in the video streaming industry, and we continue to support TLS 1.1 extensively for a wide range of "smart" TVs and set-top boxes, very frustrating, there was even a long period where large CDNs were trying to shut down 1.1 and realised they'd lose a lot of business in the streaming space if they did...
- Mandatum 6y agoInteresting, I wonder if we'll ultimately see legislation pass at some point that breaks these older TVs or non-supported devices.
- userbinator 6y agoI hope right-to-repair passes first. Only the tech industry is so brazenly authoritarian about breaking things that used to work.
- IntelMiner 6y agoI don't think that saying technology is an evolving problem is an "authoritarian" stance Software is written by human beings, human beings make mistakes. The fact these devices can't be updated by the vendor is an implicitly economic problem Right-to-repair likely wouldn't "solve" these problems for 99% of people, unfortunately. Netflix would never have its customer service people advocating to download custom firmware for smart TV's from "some Russian website" for instance The real change it would cause is allowing "tech savvy" people to carve out a niche repairing and reselling used, but functional devices. Which even if it's only a 1% decline in sales is an unacceptable proposition for companies. Selling millions of something every year somehow isn't worth it if even a single PENNY is left on the table, or "spent" in the wrong place instead of lining their pockets
- saagarjha 6y agoThe authoritarianism is that companies should be aware that technology progresses and still lock users out from their hardware so they can’t fix it when the world inevitably changes.
- nitrogen 6y agoI recently tried to get an old version of Debian up to speed, to bring some old and unique hardware back to life. The lack of support for TLS 1.3 made it impossible to download much of anything. It was basically impossible to update or upgrade. Most of the web (and HTTPS APIs) was inaccessible via curl. I imagine similar issues plague retrocomputing with other OSes. Are there any resources for retrocomputing in the TLS 1.2+ era? Maybe something like an HTTPS downgrade proxy that requires manual installation of a new cert and is targeted at retro OS isolation?
- ekianjo 6y agoCant you install a more recent curl from a non https repository ? EDIT you can also use a more recent OpenSSL backport https://github.com/mezentsev/OpenSSL-Backport https://github.com/mezentsev/OpenSSL-Backport
- nitrogen 6y agoI went down the rabbit hole of trying to piecewise update packages, and ran into glibc version differences, other packages absolutely requiring gnutls and some absolutely requiring openssl and conflicting, issues with changed certificate paths in newer versions of Debian that many apps don't know about so TLS was just broken in everything, and after many hours I gave up on that route.
- stevenicr 6y agoI had a similar experience a few months ago - A fresh debian and then stuff needed to run the Matrix/Synapse stuff - then went to do some addons and they balked at one installed thing not having the proper ssl stuff - which led into a rabbit hole of error messages and python stuff with very few search results.. only solution I could find that actually worked was someone posting a thing saying to downgrade the TLS to lower version.. Figured that might fix the main problem at the time, but then create new problems for other things. So I gave up. Will likely do a new box and new install with a different domain name to see if I can get it all working proper with modern tls/ssl stuff (think i saw something about a recent debian update doing some things with ssl and tls) - But no one got back to me on exporting user data from Synapse - of which I really just need usernames, email addys to a fresh install - so I gave up on that too.
- sipu261988 6y agoUseful and authentic Contents or information, my authentic website is similar to your wesite and we request for backlink's exchange. <a> https://govtexaminfo.com/ https://govtexaminfo.com/ </a>