Home Security Major browsers to deprecate older TLS versions from 2020
Major browsers to deprecate older TLS versions from 2020 Pixabay

Major browser makers are moving away from older versions of the Transport Layer Security protocol, with co-ordinated announcements from Microsoft, Apple, Google and Mozilla detailing the changes.

TLS provides confidentiality and integrity of data in transit between clients and servers exchanging information. Version 1.0 dates back about 20 years.

Google said TLS 1.2 had been published about 10 years ago and adopted widely.

Given that, it said the Chrome browser would deprecate TLS 1.0 and 1.1 from version 72 onwards; this would be seen by early adopters beginning in January 2020.

Mozilla said it would disable support for TLS 1.0 and 1.1 from March 2020 onwards.

"Though we are not aware of specific problems with TLS 1.0 that require immediate action, several aspects of the design are neither as strong or as robust as we would like given the nature of the Internet today," the Mozilla project's Martin Thomson said in a statement.

"Most importantly, TLS 1.0 does not support modern cryptographic algorithms."

Microsoft's announcement said it would disable TLS 1.0 and 1.1 in both its Edge and Internet Explorer browsers in the first half of 2020.

"January 19 of next year marks the 20th anniversary of TLS 1.0, the inaugural version of the protocol that encrypts and authenticates secure connections across the Web, Kyle Pflug, senior program manager, Microsoft Edge, wrote.

"Over the last 20 years, successor versions of TLS have grown more advanced, culminating with the publication of TLS 1.3, which is currently in development for a future version of Microsoft Edge."

Pflug added that while Microsoft was not aware of significant vulnerabilities with its up-to-date implementations of TLS 1.0 and TLS 1.1, vulnerable third-party implementations did exist.

"Moving to newer versions helps ensure a more secure Web for everyone. Additionally, we expect the IETF [Internet Engineering Task Force] to formally deprecate TLS 1.0 and 1.1 later this year, at which point protocol vulnerabilities in these versions will no longer be addressed by the IETF," he added.

Apple said support for TLS 1.0 and 1.1 would be removed from its Safari browser on both iOS and macOS from March 2020.

"Properly configured for App Transport Security compliance, TLS 1.2 offers security fit for the modern Web," Christopher Wood, of Apple's secure transports team, said in a statement.

"It is the standard on Apple platforms and represents 99.6% of TLS connections made from Safari. TLS 1.0 and 1.1 — which date back to 1999 — account for less than 0.36% of all connections.

"With the recent finalisation of TLS 1.3 by the IETF in August 2018, the proportion of legacy TLS connections will likely drop even further. TLS 1.2 is also required for HTTP/2, which delivers significant performance improvements for the Web."

FREE SEMINAR

Site24x7 Seminars

Deliver Better User Experience in Today's Era of Digital Transformation

Some IT problems are better solved from the cloud

Join us as we discuss how DevOps in combination with AIOps can assure a seamless user experience, and assist you in monitoring all your individual IT components—including your websites, services, network infrastructure, and private or public clouds—from a single, cloud-based dashboard.

Sydney 7th May 2019

Melbourne 09 May 2019

Don’t miss out! Register Today!

REGISTER HERE!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips

DOWNLOAD NOW!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the sitecame into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

 

Popular News

 

Telecommunications

 

Guest Opinion

 

Sponsored News

 

 

 

 

Connect