8 ms·

I don't think security updates are quite enough. Sometimes you need updates to keep functioning. For example support for TLS 1.0/1.1 or older signature algorith

I don't think security updates are quite enough. Sometimes you need updates to keep functioning. For example support for TLS 1.0/1.1 or older signature algorithms was widely removed, which can prevent old clients from connecting to most servers.

everdrive 5y ago
Would deprecated TLS not fall into the "security" category? It's hardly a feature.
- 0xcde4c3db 5y ago
  As a practical matter, it's a far cry from something like backporting a vulnerability patch. How likely is it that you can actually get TLS 1.(N+1) without a breaking change to an API?
- CodesInChaos 5y ago
  I view this as a breaking change in the behaviour of many internet servers, which happened to be motivated by security. Which is different from fixing the security of the software on the device. Some other examples of non security issues that might require modifications: * Widespread adoption hosting multiple services on the same IP, relying on SNI for TLS to function. While this is in TLS as well, it's not a security issue. In practice it was adopted slowly enough that it didn't cause many problems * A quick switch from IPv4 to IPv6 (lol) * Y2K (happened before smartphones) * timezone database changes (e.g. if the EU abolishes DST) * Regulatory changes (e.g. which frequencies the phone may send on) * A third party service the phone relies on for essential functionality gets shut down
- krageon 5y ago
  It does, plainly. Just like not using MD5 is a security concern and patching that out would be a security patch.
rex_lupi 5y ago
yes, security updates are really not enough. just consider the case of app permission hardenings on latest android versions (12/11/10)
- laurent92 5y ago
  I doubt vendors will implement 2-stream updates. Mandating 7 years probably means we’ll all have to use the most recent version.
iso1631 5y ago
Weren't phones in 2014 using TLS 1.2? It was specified in 2008.
- pvorb 5y ago
  Sure, but if you deprecated TLS 1.2 today, you'd have to make sure that all devices that are less than 7 years old will get the update.
  - iso1631 5y ago
    Is anyone talking about deprecating TLS 1.2 before 2025? (TLS 1.3 being specified in 2018 )
    - oaiey 5y ago
      TLS standards are deprecated by vulnerabilities not new Features.
      - deleted 5y ago
        [deleted]
      - iso1631 5y ago
        If phones normally receive say 2 years of updates, any phone built since 2016 - thus eol in 2023, should support it (chrome/firefox were supporting tls 1.3 in 2017) - i.e in the next 18 months. A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".
        bbarnett 5y ago
        One thing, sometimes phones are released, but manufactured for 2 or 3 years, plus sit on store shelves for a year after that. Today, you can often find such new phones on sale, yet already? No security updates. End of support. So the life of a phone model before you even buy it new, may be years...
- 5y ago
tgsovlerkhgsel 5y ago
Android 5.0 is considered as the first version fully supporting TLS 1.2 according to https://support.globalsign.com/ssl/general-ssl/tls-protocol-compatibility https://support.globalsign.com/ssl/general-ssl/tls-protocol-.... It was released end of 2014, so nearing 7 years. Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken. This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038 https://phabricator.wikimedia.org/T238038 I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger. So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.
- strenholme 5y ago
  the phone would be a brick Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick. As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support. [1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP. [2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates
  - tgsovlerkhgsel 5y ago
    True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.
    - strenholme 5y ago

everdrive 5y ago

Would deprecated TLS not fall into the "security" category? It's hardly a feature.

0xcde4c3db 5y ago
As a practical matter, it's a far cry from something like backporting a vulnerability patch. How likely is it that you can actually get TLS 1.(N+1) without a breaking change to an API?
CodesInChaos 5y ago
I view this as a breaking change in the behaviour of many internet servers, which happened to be motivated by security. Which is different from fixing the security of the software on the device. Some other examples of non security issues that might require modifications: * Widespread adoption hosting multiple services on the same IP, relying on SNI for TLS to function. While this is in TLS as well, it's not a security issue. In practice it was adopted slowly enough that it didn't cause many problems * A quick switch from IPv4 to IPv6 (lol) * Y2K (happened before smartphones) * timezone database changes (e.g. if the EU abolishes DST) * Regulatory changes (e.g. which frequencies the phone may send on) * A third party service the phone relies on for essential functionality gets shut down
krageon 5y ago
It does, plainly. Just like not using MD5 is a security concern and patching that out would be a security patch.

rex_lupi 5y ago

yes, security updates are really not enough. just consider the case of app permission hardenings on latest android versions (12/11/10)

laurent92 5y ago
I doubt vendors will implement 2-stream updates. Mandating 7 years probably means we’ll all have to use the most recent version.

iso1631 5y ago

Weren't phones in 2014 using TLS 1.2? It was specified in 2008.

pvorb 5y ago
Sure, but if you deprecated TLS 1.2 today, you'd have to make sure that all devices that are less than 7 years old will get the update.
- iso1631 5y ago
  Is anyone talking about deprecating TLS 1.2 before 2025? (TLS 1.3 being specified in 2018 )
  - oaiey 5y ago
    TLS standards are deprecated by vulnerabilities not new Features.
    - deleted 5y ago
      [deleted]
    - iso1631 5y ago
      If phones normally receive say 2 years of updates, any phone built since 2016 - thus eol in 2023, should support it (chrome/firefox were supporting tls 1.3 in 2017) - i.e in the next 18 months. A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".
      - bbarnett 5y ago
        One thing, sometimes phones are released, but manufactured for 2 or 3 years, plus sit on store shelves for a year after that. Today, you can often find such new phones on sale, yet already? No security updates. End of support. So the life of a phone model before you even buy it new, may be years...
5y ago

tgsovlerkhgsel 5y ago

Android 5.0 is considered as the first version fully supporting TLS 1.2 according to https://support.globalsign.com/ssl/general-ssl/tls-protocol-compatibility https://support.globalsign.com/ssl/general-ssl/tls-protocol-.... It was released end of 2014, so nearing 7 years. Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken. This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038 https://phabricator.wikimedia.org/T238038 I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger. So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.

strenholme 5y ago
the phone would be a brick Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick. As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support. [1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP. [2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates
- tgsovlerkhgsel 5y ago
  True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.
  - strenholme 5y ago