Re: [TLS] Prohibiting SSL 3.0

[Dave Garrett <[e-mail]>]

Martin Rex wrote:
> [...] TLS is not designed to provide protection from [...]

This is not a useful debate. What SSL/TLS was designed to do last millennium is irrelevant. We have new threat models now and have to adapt our expectations of security protocols to deal with them.

https://www.youtube.com/watch?v=MiU42KI1GUw#t=110s

There's no point in arguing about SSL3 at this point. Even if it's theoretically safe with various mitigations within a narrow use-case, very few people trust it anymore. It's archaic and long since deprecated. TLS 1.0 is obsolete for that matter. If security is the actual goal here, it really should be TLS 1.2 or bust by now. The only reason any of these old versions are supported is an unwillingness/incapability of vendors to properly coordinate upgrades and deprecations. It took a decade and a half and POODLE to get anybody to jointly axe SSL3. We should take it as good that we can move slightly into the future and move on.

I'd like to see a draft for prohibiting TLS 1.0 on the queue next. If we've learned one thing recently, it's that you shouldn't wait until the last possible moment to get rid of old protocols. We shouldn't be expecting old versions to be maintained properly with all necessary mitigations that are required, nor should we be surprised when they inevitably have some long standing flaw that eventually gets discovered.


-- Dave