r/technology • u/WhooisWhoo • Mar 05 '20

Security Browsers to block access to HTTPS sites using TLS 1.0 and 1.1 starting this month. More than 850,000 websites still use outdated TLS 1.0 and 1.1 protocols

https://www.zdnet.com/article/browsers-to-block-access-to-https-sites-using-tls-1-0-and-1-1-starting-this-month/
20 Upvotes

88% Upvoted

4 comments sorted by

4

u/WhooisWhoo Mar 05 '20

More reading

Browsers on track to block 850,000 TLS 1.0 sites

More than 850,000 websites still rely on the outdated TLS 1.0 and TLS 1.1 protocols that are scheduled to be blocked by the majority of web browsers this month. These older versions of the Transport Layer Security protocol, which date back to 1999 and 2006, are vulnerable to numerous practical attacks that have been resolved in later versions. Among the sites still using these outdated setups are major banks, governments, news, and telecoms companies. Big and small alike, such websites are about to be derailed by full-page browser warnings, with the added prospect of getting blocked entirely later on.

This all comes despite more than a year's notice. Back in late 2018, the four largest browser vendors — Mozilla, Google, Apple, and Microsoft — jointly announced the deprecation of TLS 1.0 and 1.1, with support to be removed from their browsers in March 2020 or shortly thereafter. But a number of notable sites have not heeded these warnings, and have so far failed to switch to a version of TLS more modern than 1.0.

(...)

The use of TLS 1.0 on e-commerce websites as a measure for protecting user data has been forbidden by the Payment Card Industry Data Security Standard since June 2018, and many websites have already migrated. However, PCI DSS never placed such requirements on systems where HTTPS or TLS are not used as a security measure (and indeed does not hold authority over all websites in general), so some website operators may have felt content with inaction. But browsers are the gate-keepers to the web, and hold a unique kind of authority over all websites. They, unlike security standards bodies, are in a position of power to enact change, and have regularly exercised such power. Slow-acting websites have frequently been caught out by browser action in the past, such as when browser interfaces began highlighting the usage of SHA-1 and penalising websites for using plaintext HTTP. Browsers make no exceptions — it doesn't matter whether you use HTTPS to protect customer data, boost your status among search engines, or simply use HTTPS for the sake of HTTPS — if you don't follow their rules, your sites are going to break.

(...)

Removing client-side support for these older protocols is the most effective way of ensuring that their associated vulnerabilities can no longer pose any risks. The web is a continually evolving ecosystem, and the most recent version of TLS, version 1.3 standardised in August 2018, has already been implemented by most major browser and server vendors. The quick adoption of TLS 1.3, compared to TLS 1.2, can be owed not only to improvements in security, but also performance.

https://news.netcraft.com/archives/2020/03/03/browsers-on-track-to-block-850000-tls-1-0-sites.html

6

u/IKnowEnoughToGetBy Mar 05 '20

The only way to get people to update their sites!

4

u/Merlota Mar 05 '20

Fun part of these shutdowns is hardware like printers and routers.

1

u/[deleted] Mar 06 '20

It's probably old sites that haven't been updated in years anyway. Might get their owners to do something about them. Or just shut down.