Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- TIL: there's now more than 10,000 RFCs.
- I don't see much necessity. TLS1.3 is not something that hard or costly to support. I'd suggest just mark TLS1.2 as legacy and make some practical constraints to TLS1.3 applications/implementations to avoid replay attacks.by Sha1rholder
- Do you have slightest idea on how many devices that would brick
- Interesting, nice to see older TLS versions are getting updates like that. Official guidance is definitely beneficial to squeeze out more (safe) usage since it's so widespread.by mgr42
- by nektro
- Couldn't folks just use TLS 1.3?by sidewndr46
- These prescriptions apply only to (D)TLS 1.2, since (D)TLS 1.0 and TLS 1.1 are deprecated by RFC 8996 and (D)TLS 1.3 either does not use the affected algorithms or does not share the relevant configuration options. (There is no DTLS version 1.1.)by 0ckpuppet
- better to break tons of existing installations and require confusing, arcane config file modifications just for folks to get things back to where they were before being broken
- They can and they should, but the world is not a perfect place, so backwards compatibility is neccessary.
So long as TLS 1.2 can still be used securely, its really not a big deal.
by bawolff - I think the entire point is so that many with devices that will never see updates can still continue to use those devices.by mjevans
- That question is essentially asked "Why can't we just upgrade all of our legacy systems that are more than 15 years old?" 15 years because anything running a network stack from 2011 probably doesn't support TLS1.3 unless the developers were moderately forward looking.
Most businesses have systems older than that. Most governments have systems twice as old as that. Upgrading things is hard, expensive, and in a lot of cases just not a priority. That's why old tech like TLS1.2 needs to remain secure.
by onion2k