Re: [TLS] prohibit <1.2 on clients (but allow servers) (was: prohibit <1.2 support on 1.3+ servers (but allow clients))

[Peter Gutmann <[e-mail]>]

Xiaoyin Liu <[e-mail]> writes:

>The simple reason is that we should allow normal users to gradually upgrade
>their old browsers/operating systems, but should encourage (or require)
>webmasters to upgrade their servers as soon as possible in order to protect
>their users' security and privacy.

This comment again shows the rather myopic browser-centered view of TLS that
I've complained about in the past.  For most of the users of TLS that I work
with, there is no browser, no OS upgrade, and no web.  TLS is used for
machine-to-machine communications, with no human intervention.  You know the
PLC I used as an example in an earlier message, the one that rejects any
attempt at connecting with a version number set to greater than TLS 1.0?  The
"upgrade" procedure for that is to replace it when the hardware dies, with a
minimum (minimum, not maximum) lifetime of around ten years (I've seen
refridgerator-sized PLCs dating from the 1960s still in active use today, but
that's because they're practically indestructible compared to modern
versions).

So if some sort of BCP is published, it should explicitly target browsers and
web servers where this kind of upgrade/change is possible.  Telling people to
throw away their PLCs and replace them with new ones isn't going to fly.

Peter.