Re: [TLS] prohibit <1.2 support on 1.3+ servers (but allow clients)

[Dave Garrett <[e-mail]>]

On Thursday, May 21, 2015 06:34:08 pm Yoav Nir wrote:
> > On May 22, 2015, at 1:16 AM, Dave Garrett <[e-mail]> wrote:
> > On Thursday, May 21, 2015 05:50:26 pm Yoav Nir wrote:
> >> According to netmarketshare.com Windows XP is still 16% of desktops/laptops (as measured by web traffic). Add some older mac OS X versions and you reach 17%. Even mobile has some older versions. What this is proposing is to require servers to cut all of those off as a pre-requisite to supporting TLS 1.3.
> > 
> > Windows XP & old Mac OS X users can install Mozilla Firefox or Google Chrome (or one of the browsers based on one). It's just the built in browser that won't work because the vendor dropped support.
> 
> And you are proposing that we force them to do this? Worse, you are proposing that we deputize all server operators in forcing them to replace their browser?

Force them to not use IE8? Oh, the humanity.

I'm saying it's a joke to say a server is secure when it still knowingly supports a security protocol from 16 years ago that has been replaced 3 times over. (2, prior to 1.3) At minimum, I'm saying a server that actually does that shouldn't be allowed to pretend it's compliant with modern security standards.

Every time there's some new catastrophic vulnerability that's discovered (but of course, always existed) that involves some decade plus old junk, people feign surprise and slowly get around to dealing with the issue. This latest weak DH issue has been known to exist in some form for years, yet now, all of a sudden, we're bothering to deal with it because someone found out it was worse. There are trivial measures that, whilst having massive consequences, can be done proactively with real effect. Agreeing to disable protocols leftover from the '90s is a start. We know TLS 1.0 and 1.1 are not as secure as they should be, that's why TLS 1.2 exists and why TLS 1.3 is being designed. It's not some secret; they were replaced for legitimate reasons that we should stop ignoring if we want this protocol to have legitimacy.

I'd like to be able to point to the TLS 1.3 spec and tell people that servers implementing it are as secure as we currently know how to make them, which is just not true unless their weakest link isn't obsolete crap.


Dave