4 ms·

Android 5.0 is considered as the first version fully supporting TLS 1.2 according to https://support.globalsign.com/ssl/general-ssl/tls-protocol-compatibility h

Android 5.0 is considered as the first version fully supporting TLS 1.2 according to https://support.globalsign.com/ssl/general-ssl/tls-protocol-compatibility https://support.globalsign.com/ssl/general-ssl/tls-protocol-.... It was released end of 2014, so nearing 7 years. Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken. This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038 https://phabricator.wikimedia.org/T238038 I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger. So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.

strenholme 5y ago
the phone would be a brick Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick. As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support. [1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP. [2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates
- tgsovlerkhgsel 5y ago
  True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.
  - strenholme 5y ago
    For me, if my phone still made phone calls, still sent texts, still got critical security updates, but I were forced to get Firefox from the app store to browse the modern TLS 1.2 web, I would consider it still quite usable. For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.
deleted 5y ago
[deleted]
fulafel 5y ago
Browsers don't have to use the base os TLS libs.
- tgsovlerkhgsel 5y ago
  True, but I expect enough things to break that no non-desperate person would want to use that.
- Fradow 5y ago
  In fact, Chrome does use its own TLS libs and don't have any trouble connecting on TLS 1.2 on Android 4.4. On the other hand, nearly every application use the base OS TLS libs and cannot connect anymore to servers that disabled TLS 1.0/1.1 on Android 4.4.
  - fulafel 5y ago
    Yep. But this is probably a good thing, since those out of date libs are likely to be vulnerable from today's POV. To engineer the app work remotely safely on such vendor-abandoned devices you need to basically assume you're running on a malware or rootkit compromised device, and just hope that by using your self bundled components you'll have better chances to survive in the core wars game because your app is not being specifically targeted.

strenholme 5y ago

the phone would be a brick Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick. As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support. [1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP. [2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates

tgsovlerkhgsel 5y ago
True, the brick was an exaggeration. I thought about the "applications bundling SSL libraries", but especially on a phone, I expect enough things to break to result in a user experience that most would not be willing to accept.
- strenholme 5y ago
  For me, if my phone still made phone calls, still sent texts, still got critical security updates, but I were forced to get Firefox from the app store to browse the modern TLS 1.2 web, I would consider it still quite usable. For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.

deleted 5y ago

[deleted]

fulafel 5y ago

Browsers don't have to use the base os TLS libs.

tgsovlerkhgsel 5y ago
True, but I expect enough things to break that no non-desperate person would want to use that.
Fradow 5y ago
In fact, Chrome does use its own TLS libs and don't have any trouble connecting on TLS 1.2 on Android 4.4. On the other hand, nearly every application use the base OS TLS libs and cannot connect anymore to servers that disabled TLS 1.0/1.1 on Android 4.4.
- fulafel 5y ago
  Yep. But this is probably a good thing, since those out of date libs are likely to be vulnerable from today's POV. To engineer the app work remotely safely on such vendor-abandoned devices you need to basically assume you're running on a malware or rootkit compromised device, and just hope that by using your self bundled components you'll have better chances to survive in the core wars game because your app is not being specifically targeted.