This repository was archived by the owner on Nov 6, 2023. It is now read-only.
Repository navigation
This repository was archived by the owner on Nov 6, 2023. It is now read-only.
Firefox will disable support for TLS 1.0 and TLS 1.1 #18434
Description
Type: code issue
In March of 2020, Firefox will disable support for TLS 1.0 and TLS 1.1.
We might have to update Travis to accommodate the change, see https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls
Google Chrome will deprecate TLS 1.0 and TLS 1.1 in C72, see https://security.googleblog.com/2018/10/modernizing-transport-security.html
EDIT: Fixed URL to https-everywhere-checker
Reacted by Marek33, pipboy96, Hugo Gruson and Alexis
Activity
pipboy96 commentedon Sep 24, 2019
@cschanaj Chrome 77 still has TLS 1.0 and TLS 1.1 enabled. IMO March 2020 is not a date that should cause immediate concern. I feel this should be closed for time being.
cschanaj commentedon Sep 26, 2019
I think this is similar to #17912 in the sense that once the vendor removed the support for TLS 1.0 and TLS 1.1, we will be redirecting our users to malfunction pages. IMHO We should act early by requiring TLS 1.2 or later on Travis to minimize the impact it might have.
pipboy96 commentedon Sep 26, 2019
@cschanaj Makes sense, we need @zoracon's opinion though.
pipboy96 commentedon Sep 26, 2019
To be honest, any website that doesn't support at least TLS 1.2 may reasonably be expected to have other issues, such as mixed content or lack of support of secure ciphers. I am for this change.
zoracon commentedon Sep 26, 2019
@cschanaj Considering that these browsers will likely put up security warnings for sites on TLS 1.0 and 1.1. I want to check out and investigate the SSL warning they will likely be thrown in the error object (unless someone already knows this). Because we will have to update Travis and some of the JS in
background.jsthat accounts for SSL warnings.Gonna dig through these pre-release versions and correspond with a contact to account for that future SSL warning that will likely be thrown
TLDR;
I support this, just don't want to make this change until I confirm that it has been disabled in Beta (unless someone knows that they have or not already in this thread)
pipboy96 commentedon Sep 26, 2019
@zoracon I may test right now.
pipboy96 commentedon Sep 26, 2019
@zoracon Current macOS Nightly still has TLS v1.0 enabled.
zoracon commentedon Sep 26, 2019
Thank you for testing @pipboy96, going to reach out and see what updates they have on this timeline. Let's hold off for now, but thank you for bringing this to attention @cschanaj
pipboy96 commentedon Sep 26, 2019
@zoracon I can also test HTTPS Everywhere on Chromium version of Edge.
cschanaj commentedon Sep 26, 2019
@zoracon @pipboy96 in case you might want to test anything, https://alum.ust.hk/ uses TLSv1.0 and throws warning in Firefox 69 console.
zoracon commentedon Oct 16, 2019
Nightly has the warning up! This will be in stable in December. So let's plan by end of November to update Travis.
zoracon commentedon Oct 16, 2019
Also, I rather we not have the interstitial EASE page for this warning, since the page does not offer a way to enable TLS 1.0, 1.1. I want to stay out of the browser's way on this one.
pipboy96 commentedon Oct 17, 2019
@zoracon Does this create an EASE page right now?
pipboy96 commentedon Oct 18, 2019
@zoracon I tested with Nightly and it doesn't show an EASE warning.
zoracon commentedon Nov 18, 2019
Green lighting this since we are coming to the end of the month.
pipboy96 commentedon Nov 18, 2019
@zoracon Are we going to do a full fetch test soon?
zoracon commentedon Nov 18, 2019
Yes, and starting here so installs and versions are up to date. Looking into this portion today and #13829 to look over the items needed to be done to run this
Detect and comment the use of SSL versions earlier than TLS 1.2