5 ms·

I work in the video streaming industry, and we continue to support TLS 1.1 extensively for a wide range of "smart" TVs and set-top boxes, very frustrating, ther

I work in the video streaming industry, and we continue to support TLS 1.1 extensively for a wide range of "smart" TVs and set-top boxes, very frustrating, there was even a long period where large CDNs were trying to shut down 1.1 and realised they'd lose a lot of business in the streaming space if they did...

Mandatum 6y ago
Interesting, I wonder if we'll ultimately see legislation pass at some point that breaks these older TVs or non-supported devices.
- userbinator 6y ago
  I hope right-to-repair passes first. Only the tech industry is so brazenly authoritarian about breaking things that used to work.
  - IntelMiner 6y ago
    I don't think that saying technology is an evolving problem is an "authoritarian" stance Software is written by human beings, human beings make mistakes. The fact these devices can't be updated by the vendor is an implicitly economic problem Right-to-repair likely wouldn't "solve" these problems for 99% of people, unfortunately. Netflix would never have its customer service people advocating to download custom firmware for smart TV's from "some Russian website" for instance The real change it would cause is allowing "tech savvy" people to carve out a niche repairing and reselling used, but functional devices. Which even if it's only a 1% decline in sales is an unacceptable proposition for companies. Selling millions of something every year somehow isn't worth it if even a single PENNY is left on the table, or "spent" in the wrong place instead of lining their pockets
    - saagarjha 6y ago
      The authoritarianism is that companies should be aware that technology progresses and still lock users out from their hardware so they can’t fix it when the world inevitably changes.
    - selfhoster11 6y ago
      > Netflix would never have its customer service people advocating to download custom firmware for smart TV's from "some Russian website" for instance They wouldn't tell that to people directly, but they could tell you to go to a repair man. Who then, would proceed to download that same firmware from the Russian website and apply it, and the TV now works. Netflix gets to keep their reputation, and the customer is happy with the TV.
- mtgx 6y ago
  "Smart" devices should get software support (in a timely manner, like 3-6 months after a bug is reported) for as long as 20%+ of the buyers continue to use those devices. If that's 15 years, then they should get support for 15 years. If 10 million people get a certain Samsung Smart TV model, and 15 years later, 3 million of those buyers continue to use that model, then Samsung should continue to support it until it's fewer than 2 million, at least. Then these OEMs can decide if throwing some much garbage onto these devices is actually worth it to them in the long term.
elithrar 6y ago
Customers regularly ask us whether we support TLS 1.0 and 1.1 for this very reason. We do, and support policies to raise the min version, but that’s not the default. Smart TVs and many streaming boxes often ship with vendored libcurl/OpenSSL/other libraries that are already years old when the device itself is new. It is frustrating and insecure, but cutting these users out isn’t a clear solution either.
- koheripbal 6y ago
  ...then again, I imagine the security of me streaming Resident Alien on my Roku isn't really a big concern for me. hmm... unless my Amazon credential handshake is in that?
  - Sohcahtoa82 6y ago
    Possibly. But it's not like the attacks on TLS 1.0 and 1.1 are trivial. To successfully break a single encrypted connection requires massive server farms. The people actually attempting to maliciously break TLS handshakes are working on much bigger targets.
  - rakoo 6y ago
    It's not an issue, until someone finds a way to mitm the request, send a special payload to your Roku that is then opened by an unpatched ffmpeg (https://www.linuxcompatible.org/story/asa2020074-ffmpeg-arbitrary-code-execution/ https://www.linuxcompatible.org/story/asa2020074-ffmpeg-arbi...) that allows an RCE and turn your Resident Alien into a Resident Zombie.
  - elithrar 6y ago
    Your credentials might go to a different endpoint, but the device is still limited in its TLS support as a client. The attacks aren’t entirely practical, and the threat model for “someone cares enough to MitM my streaming connection” isn’t a common one, but it’s much closer to practical compared to attacks on TLS 1.2 & 1.3.
nodefortytwo 6y ago
I am in the same industry and we have the same problem. We are moving to having "insecure" proxies that support TLS 1.1 for devices that can't update. It won't add much security but at least demonstrates its was an active decsion to support it rather than a config mistake.
oytis 6y ago
But if these smart TVs are connected, they can also be updated, right?
- kowlo 6y ago
  They are rarely updated
- selfhoster11 6y ago
  They won't, because the manufacturers aren't bothered about it.
  - spicybright 6y ago
    "Oh, there's a critical security hole in one of our products? Sorry, it's discontinued, buy a new one to fix it." So frustrating.
- verytrivial 6y ago
  I know [edit: guessing] you're not being serious, but until there are laws mandating this in given markets, the security risks will ALWAYS be unknowingly carried by the consumer. In a hypothetical world where a manufacturer differentiates by advertising a product as "Now with security updates guarenteed for 10 years!" consumers will suddenly realise they've been sold garbage until that point. It just won't happen.
  - spacemanmatt 6y ago
    Without a promised based on source code escrow, it's just not worth anything to me. I VERY much support this sort of thing, though.
- jiggawatts 6y ago
  Or for that matter: any digital device that is not a computer or a mobile phone. When was the last time you applied a security update for your networked printer? I'm guessing never, because no printer vendor has a security department, none have security updates, etc... This is why smart networked printers are where state-sponsored attackers like the NSA like to hide their persistent malware...

Mandatum 6y ago

Interesting, I wonder if we'll ultimately see legislation pass at some point that breaks these older TVs or non-supported devices.

userbinator 6y ago
I hope right-to-repair passes first. Only the tech industry is so brazenly authoritarian about breaking things that used to work.
- IntelMiner 6y ago
  I don't think that saying technology is an evolving problem is an "authoritarian" stance Software is written by human beings, human beings make mistakes. The fact these devices can't be updated by the vendor is an implicitly economic problem Right-to-repair likely wouldn't "solve" these problems for 99% of people, unfortunately. Netflix would never have its customer service people advocating to download custom firmware for smart TV's from "some Russian website" for instance The real change it would cause is allowing "tech savvy" people to carve out a niche repairing and reselling used, but functional devices. Which even if it's only a 1% decline in sales is an unacceptable proposition for companies. Selling millions of something every year somehow isn't worth it if even a single PENNY is left on the table, or "spent" in the wrong place instead of lining their pockets
  - saagarjha 6y ago
    The authoritarianism is that companies should be aware that technology progresses and still lock users out from their hardware so they can’t fix it when the world inevitably changes.
  - selfhoster11 6y ago
    > Netflix would never have its customer service people advocating to download custom firmware for smart TV's from "some Russian website" for instance They wouldn't tell that to people directly, but they could tell you to go to a repair man. Who then, would proceed to download that same firmware from the Russian website and apply it, and the TV now works. Netflix gets to keep their reputation, and the customer is happy with the TV.
mtgx 6y ago
"Smart" devices should get software support (in a timely manner, like 3-6 months after a bug is reported) for as long as 20%+ of the buyers continue to use those devices. If that's 15 years, then they should get support for 15 years. If 10 million people get a certain Samsung Smart TV model, and 15 years later, 3 million of those buyers continue to use that model, then Samsung should continue to support it until it's fewer than 2 million, at least. Then these OEMs can decide if throwing some much garbage onto these devices is actually worth it to them in the long term.

elithrar 6y ago

Customers regularly ask us whether we support TLS 1.0 and 1.1 for this very reason. We do, and support policies to raise the min version, but that’s not the default. Smart TVs and many streaming boxes often ship with vendored libcurl/OpenSSL/other libraries that are already years old when the device itself is new. It is frustrating and insecure, but cutting these users out isn’t a clear solution either.

koheripbal 6y ago
...then again, I imagine the security of me streaming Resident Alien on my Roku isn't really a big concern for me. hmm... unless my Amazon credential handshake is in that?
- Sohcahtoa82 6y ago
  Possibly. But it's not like the attacks on TLS 1.0 and 1.1 are trivial. To successfully break a single encrypted connection requires massive server farms. The people actually attempting to maliciously break TLS handshakes are working on much bigger targets.
- rakoo 6y ago
  It's not an issue, until someone finds a way to mitm the request, send a special payload to your Roku that is then opened by an unpatched ffmpeg (https://www.linuxcompatible.org/story/asa2020074-ffmpeg-arbitrary-code-execution/ https://www.linuxcompatible.org/story/asa2020074-ffmpeg-arbi...) that allows an RCE and turn your Resident Alien into a Resident Zombie.
- elithrar 6y ago
  Your credentials might go to a different endpoint, but the device is still limited in its TLS support as a client. The attacks aren’t entirely practical, and the threat model for “someone cares enough to MitM my streaming connection” isn’t a common one, but it’s much closer to practical compared to attacks on TLS 1.2 & 1.3.

nodefortytwo 6y ago

I am in the same industry and we have the same problem. We are moving to having "insecure" proxies that support TLS 1.1 for devices that can't update. It won't add much security but at least demonstrates its was an active decsion to support it rather than a config mistake.

oytis 6y ago

But if these smart TVs are connected, they can also be updated, right?

kowlo 6y ago
They are rarely updated
selfhoster11 6y ago
They won't, because the manufacturers aren't bothered about it.
- spicybright 6y ago
  "Oh, there's a critical security hole in one of our products? Sorry, it's discontinued, buy a new one to fix it." So frustrating.
verytrivial 6y ago
I know [edit: guessing] you're not being serious, but until there are laws mandating this in given markets, the security risks will ALWAYS be unknowingly carried by the consumer. In a hypothetical world where a manufacturer differentiates by advertising a product as "Now with security updates guarenteed for 10 years!" consumers will suddenly realise they've been sold garbage until that point. It just won't happen.
- spacemanmatt 6y ago
  Without a promised based on source code escrow, it's just not worth anything to me. I VERY much support this sort of thing, though.
jiggawatts 6y ago
Or for that matter: any digital device that is not a computer or a mobile phone. When was the last time you applied a security update for your networked printer? I'm guessing never, because no printer vendor has a security department, none have security updates, etc... This is why smart networked printers are where state-sponsored attackers like the NSA like to hide their persistent malware...