CybserSecurity News

Tag: TLS 1.0

  • Microsoft will disable TLS 1.0 and 1.1 in Internet Explorer and EdgeHTML on September 13

    In 2018, Microsoft announced that it would phase out the TLS 1.0 and TLS 1.1 protocols in Internet Explorer, both of which are obsolete and no longer secure and should not continue to be used. However, the COVID-19 epidemic in 2020 may make it too busy for enterprises to transform existing infrastructure, and rashly disabling the above protocols may cause enterprises to encounter problems in use, so Microsoft decided to postpone the date of the ban.
    Mozilla Firefox no longer supports TLS
    Now Microsoft has decided to disable TLS 1.0 and 1.1 in Internet Explorer and EdgeHTML on September 13. IT Admins who want to disable TLS 1.0 and 1.1 before the announced date can do that using dedicated rules in Group Policy Editor.
    Personal users are actually very simple to configure, just re-check TLS 1.0 and TLS 1.1 in the advanced Internet options (Tools > Internet Options > Advanced), of course, professional users can also configure through group policies.

    Via: Neowin

  • IETF officially deprecated TLS 1.0 and TLS 1.1

    The Internet Engineering Task Force (IETF) has announced that TLS 1.0 and TLS 1.1 are officially abandoned. The announcement states that TLS 1.0 (RFC 2246) and TLS 1.1 (RFC 4346) have been officially deprecated. These versions lack support for current and recommended encryption algorithms and mechanisms, and many governments and industries now require TLS applications to avoid using these old TLS versions.
    TLS 1.2 became the IETF recommended version in 2008, so the IETF believes that enough time has been reserved for users to get rid of the dependence on the old version of TLS. It also stated that removing support for older versions can reduce the attack surface, reduce the chance of misconfiguration, and simplify the maintenance of libraries and products.
    TLS 1.0 was released in 1999, and nearly 20 years after its release, about 2018, the IETF has begun to discuss the deprecation of TLS 1.0 and 1.1. At that time, several mainstream browsers also announced plans to abandon TLS 1.0 and TLS 1.1 in 2020.

    TLS 1.3 was released in August 2018. Its breakthrough improvements include a faster handshake to speed up the connection, simplified encryption methods supported, and better speed and performance than TLS 1.2.

  • Microsoft will support TLS 1.3 protocol in Windows 10 21H1

    Windows 10 21H1 version is a new version that Microsoft will launch in the spring of 2021. Although it is a new version, this version is only a minor update without new features.

    However, Microsoft has brought some system optimizations and improvements in this version, such as DNS over HTTPS encrypted query protocol and TLS version 1.3 security protocol.

    At present, these security protocols have been supported in the Windows 10 beta, but Microsoft has not clearly stated when the stable channel will provide support.

    According to the latest support document officially released by Microsoft, both Windows 10 21H1 and Windows Server 21H1 will support the TLS 1.3 protocol.

    Mozilla Firefox no longer supports TLS

    This protocol is the latest stable version of the TLS protocol. At present, the encryption security protocol adopted by most websites is TLS 1.2 version, and TLS 1.1 & TLS 1.0 will soon be abandoned.

    In fact, Microsoft has started to abandon TLS 1.1 & TLS 1.0 in the IE browser. The main reason for the abandonment of the old version is that there are some security flaws and it is not safe enough.

    Therefore, support for the latest version of the protocol helps to expand the use of the security protocol. After all, the old version is always replaced by the new version, but it takes some time to transition.

    If nothing happens, Windows 10 21H1 will also support the DNS over HTTPS function, which is designed to encrypt DNS queries to prevent sniffing.

    At present, DNS query protocols are mainly plaintext queries, so network operators can snoop on the user access information. This practice can be prevented by enabling HTTPS encryption.

    However, Microsoft has not yet clearly stated whether the DoH function will be supported in the 21H1 version, and it has already supported configuring DoH during the Windows 10 Dev test phase.

    So we can also look forward to this feature. After the stable version provides support, we can set Windows 10 to encrypt queries to improve privacy and security.