319

Update (2020-02-13): This change was completed last night on the Fastly side. Most of our endpoints now have TLS 1.0 and 1.1 disabled. We’ll be addressing our direct load balancers next.

Update (2020-02-25): This change was applied to our load balancers directly - TLS 1.0 and 1.1 are now disabled for all Stack Exchange properties.


As part of our regular efforts to increase security and keep up with the times, we will be disabling TLS 1.0 and 1.1 for Stack Exchange services on February 12th, 2020. TLS 1.2 and above will continue to work. Note: this will not immediately affect all services. Some of our services are handled via Fastly, and some at our load balancers directly - this change will not affect both segments at once. Things like Q&A, Talent, etc. flow through Fastly and will be the first affected. Things that are direct, like Chat and our API, will not be affected immediately.

Why?

Most browsers and operating systems moved to TLS 1.2 quite a while ago now (for example, we don't support Windows XP...and neither does Microsoft). We held out for as many clients as possible to move over, but now it's time to make the change. If you're curious what the vulnerabilities are in TLS 1.0 and 1.1, there's a good writeup here. We've been monitoring traffic levels over the past few months and we are now at HTTPS stats of:

  • TLS 1.0: 0.6%
  • TLS 1.1: 0.0%
  • TLS 1.2: 99.4%

Additionally, it looks like the vast majority of the TLS 1.0 traffic is bots (and/or sends no user agent at all) - our estimate is that 'not a robot' requests account for less than a third of that 0.6%.

As an example of the industry moving on here, our current SSL Labs rating is a B. This is purely because of remaining TLS < 1.2 support that we plan to remove here. (Update: we are now at an A+ rating.)

If anyone has questions, please feel free to comment or answer below and we'll try and keep up.

  • 131
    Thanks for informing the community in advance for a change ;-) – cs95 is disappointed with SE Feb 6 at 7:18
  • 10
    Will (or do) you have a failover page that will show an "upgrade your browser" message to any browsers stuck on 1.0 or 1.1? – Robotnik Feb 6 at 11:28
  • 64
    @Robotnik nope, not in this case. Not because we're lazy, but because it just wouldn't help. The failure scenario of an ancient client is they can't connect, so they'd never get be able to see such a page. This happens earlier in the negotiation, before any web traffic is exchanged. – Nick Craver Feb 6 at 11:47
  • 4
    @NickCraver, but currently you support both. Why not replace handling of old tls by sending to a separate fallback? – Qwertiy Feb 6 at 18:07
  • 54
    @Qwerity Let me flip that around: why do that work and maintain it? And for how long? Note: we have to explain to people why it’s still enabled, etc. it’s not a zero cost to leave it on. Given it’s not affecting actual users as far as we can tell, what’s the benefit? Any bots or users relying on this ancient path won’t get what they’re after, so why play around and spend time on a half measure? We simply have limited time and resources (like most people), so maintaining old, almost completely unused, and insecure infrastructure is not a compelling thing to use those resources on. – Nick Craver Feb 6 at 18:12
  • 35
    Nearly everybody who's paying attention and running a site has obsoleted or is in the process of removing TLS 1.0 and 1.1 compatibility. If somebody has an old browser that can't handle that, they're going to be blocked at most sites they visit. Stack Exchange will be the least of their worries. – Ask About Monica Feb 6 at 19:14
  • 13
    For that poor less than a third of 0.6% of clients I wonder what site they'll turn to to ask for help on why they can no longer connect to Stack Exchange. – BACON Feb 6 at 22:19
  • 12
    @Robotnik Most traffic using weak ciphers are bots attempting to exploit vulnerabilities. If real users are on devices incapable of using current generation SSL ciphers, they are most likely unable to upgrade them anway. Maintaining a failover page simply wouldn't achieve any useful outcomes. – user1751825 Feb 7 at 1:48
  • 4
    I welcome this change! TLS 1.0 and 1.1 should have been abandoned long ago. – MechMK1 Feb 10 at 10:53
  • 6
    @user1751825 A family member. Not because the sites to ask on weren't reachable, but because these are the people would be asking a family member anyway. – Jasper Feb 10 at 16:59
  • 2
    If the failover page (and only the failover page) was plain HTTP, the "could not reach the warning" issue would not be an issue. Also I'm interested in the rationale behind assuming that the world has left TLS < 1.2 behind because I have a Nintendo 3DS, a handheld still officially supported, and the browser only supports TLS 1.0 as per official documentation. Sure, I don't think I'll be browsing SO on a Nintendo 3DS but I don't see why I should be prevented from. – Luis Machuca Feb 12 at 1:19
  • @BACON - maybe quora.com? It's what most searches for literal question titles available at Stack Exchange end up leading to when excluding SE from search options, even in Google. – Luis Machuca Feb 12 at 1:20
  • 3
    @LuisMachuca Even the Nintendo 3DS (old and new revisions) support TLS 1.2, per the official documentation: en-americas-support.nintendo.com/app/answers/detail/a_id/13802/… – Nick Craver Feb 12 at 11:18
  • 3
    ...Huh, the one I got says TLS 1.0 and even Wikipedia backs it up, but yes testing on my own console shows TLS 1.2 support. Must have been a firm upgrade that did not see much lightshow. – Luis Machuca Feb 12 at 15:18
  • 2
    @Robotnik Failover will go against the purpose of removing older TLS version... The attacker always presents itself as an old browser that only supports the least secure cipher that you allow in your web server. The only safe option is to completely disallow unsecure communication. – inemanja Feb 21 at 18:39
133

Removing support for outdated security technologies is surely a good move. But

I see your statistics includes only TLS 1.2, so do you have any plan for TLS 1.3? It's the new standard in 2018 and is supported by all major browsers (excl. IE) and a lot of cloud services (Cloudflare, AWS ELB etc.). I really think that should be added as well.

|improve this answer|||||
  • 3
    Without knowing the "guts" inside SE, it could be that there are backend components (and subcomponents between backends and UIs or the edge) that do not support TLS 1.3 equally. For example, TLS 1.3 is supported in Java 11, but it is not included in earlier versions, and there's a ton of Java middleware that for one reason or another are still running in earlier versions (we run Java 7 at work.) I suspect it will take a few years before TLS 1.3 become the 90.xxx% supported norm. – luis.espinal Feb 6 at 9:01
  • 4
    IIRC they're a .NET shop, so if they're restricted to a .NET version < 4.6 then TLS 1.3 is not available. – Matt Ellen Feb 6 at 9:16
  • 2
    I'm aware about dependency restrictions in a large corporation (we use unencrypted transmission in our laboratory intranet, which is pretty small per se), but what about the public-facing part? – iBug is disappointed in SE Feb 6 at 9:23
  • 113
    Good question! Yes, we are looking at TLS 1.3...but don't want to combine such changes. That will be a later follow-up once we get 1.0 and 1.1 off the radar here :) Since it's a 2-leg negotiation from you to Fastly to us, we have the ability to enable TLS 1.3 to users before the backend if needed...but all components of the stack are 1.3 compatible for the curious :) – Nick Craver Feb 6 at 11:14
  • 1
    @iBugisdisappointedinSE TLS 1.3 is not supported by AWS yet docs.aws.amazon.com/elasticloadbalancing/latest/application/… – mbaird Feb 10 at 17:06
  • 2
    IE just is a major browser, no doubt about it. Whether it should be or not is open to discussion. Microsoft should have supported those users whose sites depended on IE much better. I've had to do a lot of work with "use compatibility mode" but this gets into a whole different debate …. – JosephDoggie Feb 11 at 20:59
  • @mbaird I must have misread something. Anyways, that's not important in this context. – iBug is disappointed in SE Feb 12 at 4:38
  • 3
    @JosephDoggie SE doesn't officially support IE anymore. Their position used to be "we will support IE until it starts breaking". It started breaking in 2018 and major functionality started breaking in 2019 so it's no longer on the list anymore, (thank goodness). Besides, Edge at this point has more market share than IE11 in most trackers. – TylerH Feb 12 at 14:45
  • 1
    @TylerH -- my point wasn't whether or not SO 'supports' IE, merely that it still is a major browser. It is unfortunate that Microsoft abandoned many of their customers who counted on IE. I have worked on apps that only worked on IE, and were destined to have to "use compatibility mode". Microsoft broke IE in order to comply with standards. Standards-compliance is a good thing, breaking aa major browser is NOT. – JosephDoggie Feb 12 at 21:01
  • 3
    @JosephDoggie I don't really consider it abandonment. Unless you also are upset about Microsoft no longer supporting Windows 95? They gave everyone plenty of advance notice that IE was being replaced by a new browser. – TylerH Feb 12 at 21:08
  • 3
    @JosephDoggie Microsoft does support their products, typically 10 years/version. Enterprise environments should know this going in; nothing is supported forever. You are free to support whatever software you want as long as you want, so long as you also assume the costs of doing so. Also, car companies do regularly decide parts are no longer going to be available for older models. Or are you telling me you can call up Ford and ask for a new steering wheel for your Model T? Vehicles have a different life expectancy, but they still have an end-of-life for parts & support, just like software. – TylerH Feb 12 at 21:42
  • 3
    @JosephDoggie So, what OS is supported forever? Even Linux distributions have a EOL. Every software version has a support time life. – Magnetron Feb 13 at 19:22
  • 1
    @Magnetron Windows 7 is supported until 2023. – InterLinked Feb 16 at 0:47
  • 1
    @InterLinked Support for end users ended in the last month. That extra 3 years is only for paid enterprise customers. – iBug is disappointed in SE Feb 16 at 3:01
  • 1
    @iBugisdisappointedinSE So Microsoft would like you to believe – InterLinked Feb 16 at 13:20
65

EDIT: now fixed

When you write "we will be deprecating TLS 1.0 and 1.1", do you mean that they will no longer work after next week?

It seems so from your next sentence, but this is confusing to me, because in my experience that is not what "deprecating" means in the programming world:

Software deprecation

While a deprecated software feature remains in the software, its use may raise warning messages recommending alternative practices; deprecated status may also indicate the feature will be removed in the future. Features are deprecated rather than immediately removed, to provide backward compatibility, and to give programmers time to bring affected code into compliance with the new standard.

from https://en.wikipedia.org/wiki/Deprecation, and, from https://en.wiktionary.org/wiki/deprecate (emphasis mine):

  1. (transitive, chiefly computing) To declare something obsolescent; to recommend against a function, technique, command, etc. that still works but has been replaced.
|improve this answer|||||
  • 12
    In this context it means they're being removed, yep - deprecated in favor of TLS 1.2 which all supported clients support. It turns out we just found a bug in non-SNI certificate delivery late last night as well, which means non-SNI clients (huge overlap with TLS < 1.2 support) weren't getting a valid cert, since December 24th. While we're already working with Fastly to get that cert API fixed, it also gives us even more confidence: this change will have very minimal impact. – Nick Craver Feb 6 at 11:18
  • 79
    @NickCraver Then I strongly suggest that you change the wording. That is not what "deprecating" means. I suggest to use the words "we will be removing support for TLS 1.0 and 1.1" instead. – Federico Poloni Feb 6 at 11:20
  • 44
    Fair enough! Done :) – Nick Craver Feb 6 at 11:22
  • 10
    Q&A-style discussions are weird because I'm not sure to +1 this or not. I mean, it was a good observation such that, typically, it'd be an easy +1. Except now that it's been fixed, this doesn't really provide value to readers. But the current system gives rep to answerers who make positive contributions, and it doesn't seem like this answerer deserves less rep just because their contribution was immediately actionable. But then this could've been a comment instead, which wouldn't have given rep anyway. But then is that consistent in the first place? – Nat Feb 6 at 13:49
  • 10
    @Nat I think you're overthinking this ;) – maxathousand Feb 6 at 14:11
  • 29
    @Nat What is weird, in my view, is using a Q&A-style system for an announcement, and soliciting questions about the announcements to be posted as answers (presumably, to be answered by the SE staff in comments). It all feels like using the system backwards. (See also: dogfooding, inner platform effect.) – Federico Poloni Feb 6 at 14:20
  • 7
    @Federico Poloni - I agree with you. It's a misuse of the Q&A format and a bad example to the other sites. IMHO it'd be better if meta had a slightly different format than all other sites. – LawrenceC Feb 6 at 21:30
  • 4
    Honestly, the Q&A format for meta is usually a bad fit. It's just the hammer that's so easily available. – Steve Bennett Feb 11 at 1:34
  • 1
    @SteveBennett: Pretty much. I have my issues with the decision to have meta sites use the same framework as mainsite Q&A sites to begin with, but that's a much larger problem that's not really relevant to this particular issue. – V2Blast Feb 11 at 20:30
  • Yes, Meta sites should be converted to traditional threaded phpBB-style forum threads; it'd work much better ;-) – TylerH Feb 12 at 14:57
  • 4
    This could have been a 1 sentence comment. – Matt K Feb 12 at 15:38
  • In a way, TLS 1.0 and 1.1 were deprecated in 2006 and 2008, respectively. Though in another way, they were deprecated once the industry started putting firm dates on their removal - October 2018 is when Microsoft, Google and Apple deprecated it in their browsers (with plans to remove it completely in 2020) – thomasrutter Feb 17 at 0:51
  • 1
    Thank you for pointing out that deprecation is not removal. I've seen more and more examples of such sloppy usage recently. Technical terms have specific meanings for a reason. – barbecue Feb 17 at 13:50
18

Running the Immuniweb.com Security Test it complains (abbreviated version):

Summary of stackexchange.com SSL Security Test

The problem is TLSv1.1 and TLSv1.0 configured with TLS_RSA_WITH_3DES_EDE_CBC_SHA enabled, that is non-compliant with PCI DSS requirements. In particular, the test complains of supporting TLSv1.0 and lack of support for TLSv1.3. in addition it says: "The HTTP version of the website does not redirect to the HTTPS version. We advise to enable redirection.".

You probably know this but the latest guidelines are: SP 800-52 Rev. 2 "Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations".

There is also hardware available, such as Symantec's SSL Visibility Appliance, which can permit security tools to operate despite end-to-end encryption; but it's expensive. Despite the expense traffic inspection is necessary unless you simply want to hope that nothing can go wrong. There are also Data Loss Prevention Appliances which can detect theft of personal information, password files, and other sensitive data; and block it before it goes over the wire.

Your move to TLS 1.2 and up is a welcome one, we wouldn't want you to go down for a few days or suffer the annoyance (warning?) of last year's hack again. Thanks for keeping on the leading edge.

|improve this answer|||||
8

Not everyone on here is a programmer or a tech expert, and in what I've seen online about this it's still technological mumbo-jumbo to me. Can someone please give a simple explanation of what exactly is this change and why is it important?

|improve this answer|||||
  • 23
    Imagine an old shack. Gradually rooms are being added to it, till it ends up a mansion, with a new main entrance, and the shack's door being reassigned as servant entrance. The main door has a good state-of-the-art lock; but everyone forgets about the old side door, and its antique lock. It works, but won't stop a savvy thief. Also, nobody's using the side door any more except the batty old grandma (and also the neighbourhood kids slam into it every now and then as a prank). – Amadan Feb 12 at 4:13
  • 20
    The residents decide to brick over the old door. It'll stop everyone from worrying about theft, the pranksters won't have a door to bang any more, and the grandma will just have to finally get used to the new key. It is also good they told everyone about it, because of the brouhaha when some of them decided to give the house a new facade but forgot to ask people if it's okay to do so. – Amadan Feb 12 at 4:14
  • 2
    @Amadan So the idea is to remove the dilapidated entrance entirely? Seems innocuous enough. What’s the catch? – DonielF Feb 12 at 4:14
  • 13
    The catch is the grandma — or, as the heavily downvoted answer by cnst suggests, the users with old devices that can only use the old protocol. They have to adapt, or not be able to access Stack Exchange any more. However, there is so few of them that Stack Exchange isn't willing to pay the cost of security, maintenance etc just for them to be able to use antique hardware. – Amadan Feb 12 at 4:22
  • 10
    The simple answer is: Using TLS at a level less than 1.2 is like installing a doggy door when you don't own a dog. Video Demonstration: "Watch Burglar Give Dog A Treat And Then Break Into Home Using Doggie Door". – Rob Feb 12 at 4:54
  • 2
    Another example is browser support. SE doesn't support Internet Explorer anymore, even though people still use it. So those using it can't use SE properly. In case of TLS those with old devices can't connect at all, but the idea is pretty much the same. No point spending lots of efforts for very few people. – Shadow Wizard is Ear For You Feb 12 at 7:52
  • 2
    Essentially "Don't use REALLY OLD insecure browsers" If you're on something that's on SE's support list, you should be fine. – Journeyman Geek Feb 13 at 11:18
  • 5
    Does "Unlike the new main entrance, the side door was wheelchair accessible" count for anything in this analogy? – Damian Yerrick Feb 13 at 18:12
-24

This is a pretty bad idea, following a trend that's based on common misunderstandings of how protocols work, and undermining the value of robustness and interoperability (also known as Postel's law).

  • Browser vendors have announced that they'll be deprecating support for TLSv1.0 and TLSv1.1 in 2020. It is often cited that TLSv1.0 is removed in order to avoid downgrade attacks. But if supported browsers don't support anything below TLSv1.2, then there's nothing for them to downgrade to, so, there doesn't seem to be a good reason to remove support on the websites as well.

  • This change means that it will no longer be possible to view your properties from older iPad, iPhone, Android and webOS devices, for little good reason. Keep in mind, these are devices that have gigabytes of storage and hundreds of megabytes of memory each, these are not some outdated devices that don't have the processing power to do common tasks, these are very powerful devices that simply have been abandoned by their vendors. This will result in an effective link rot on a rather large scale (search results from Google will no longer work), and will widen the digital gap between people who don't have the resources to buy the latest tablets, phones and other gadgets. You're effectively doing the brokering for planned obsolescence on behalf of Apple and other vendors, contributing to the global warming by deprecating very powerful devices, each with gigabytes of storage and megabytes of RAM, which are still perfectly capable of performing complex computing tasks.

  • SSL Labs rating is a B. Only a third of 0.6% of visitors require TLSv1.0. You're basically telling us that you'd rather have a better rating on a meaningless scale by completely denying access to your website only for a few million actual, real users. Is this for real? Is this what our industry has become?

Please consider doing the following instead:

  • Bring back full HTTP access. With an HSTS policy in place, none of the supported browsers will ever notice that HTTP support is even available. With HSTS (which is already in place on Stack Overflow), all http:// links are treated as https://, so, there's no effective difference for any supported browser, but the older devices that may not have recent https support could still view the site. (For new visitors, all you have to do is have an invisible pixel to your HTTPS site from the HTTP one, which will automatically install HSTS policy, and no further requests will be made over HTTP; this is trivial to accomplish, and should seamlessly support both legacy and modern browsers.)

  • Do not disable TLSv1.0 (and noone cares for TLSv1.1 either way, as there's hardly anything that supports TLSv1.1 without also supporting TLSv1.2). Even if HTTP access is available, browsers that don't support TLSv1.2 would not be able to follow the existing https:// links due to lack of TLSv1.2 support, resulting in link rot. (If there's a worry about certificate compromise with serving TLSv1.0, it's rather trivial to divert TLSv1.0 and TLSv1.2 traffic to distinct servers that each have distinct certificates, serving distinct content, without TLSv1.2-only clients being affected in any negative way; if TLSv1.0 is somehow deemed to be so insecure as to being worse than straight HTTP, then it's also an option to redirect back from HTTPS to HTTP for such old TLSv1.0-only clients in order to not contribute to link rot.)

|improve this answer|||||
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Journeyman Geek Feb 10 at 18:22
  • 16
    That is not what link rot is. The links will still work after disabling TLS 1.0 and 1.1, you will just have to use a device capable of accessing them. Your example of link rot is like saying the lights in a house will no longer work because you can no longer get through the front door to flip the light switch. – TylerH Feb 12 at 15:00
  • @TylerH the comparison is more like the house still has lights, but you cannot find it on the map — it might as well not exist, then. – cnst Feb 13 at 1:31
  • 8
    @cnst That's actually much less accurate of a comparison. – TylerH Feb 13 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .