SoylentNews is people
SoylentNews
SHA1 certificates for secure SSL/TLS communications are deprecated due to known computational vulnerabilities. To ensure secure communications, a forced deprecation sounds reasonable (i.e. refuse to connect to these). That has the side effect that it will lock out many users who are unable to use stronger hashes such as SHA256. However, if a fallback to SHA1 is provided (as Facebook is proposing), everyone will be vulnerable to SHA1 downgrade man-in-the-middle attacks.
What to do?
This discussion has been archived.
No new comments can be posted.
SHA1 Sunset Will Block Millions From Encrypted Net, Facebook Warns
|
Log In/Create an Account
| Top
| 41 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
When in panic, fear and doubt,
Drink in barrels, eat, and shout.
(Score: 2) by vux984 on Friday December 11 2015, @05:08PM
It says 7% of the worlds browsers don't support SHA256, which I can accept.
But what percentage of that 7% can't upgrade or install a modern browser alongside their antique (if for some reason they absolutely must continue using IE5 for something -- which sadly is a real thing. )
If 95% of the users on old browsers can simply download chrome or firefox or whatever then this is a much smaller problem then they claim.
(Score: 0) by Anonymous Coward on Friday December 11 2015, @05:12PM
I don't know which versions of web browsers are supported, but the major browsers no longer install on at least old versions of OSX. I still support the forced transition instead of downgrade support.
(Score: 2, Redundant) by pendorbound on Friday December 11 2015, @05:22PM
Current Firefox installs down to SnowLeopard which was released in 2009. The last PPC-based Mac (that can't update to Snowy) was released in 2006.
No question you still have people out there using PPC Mac's, but I think it's time... Maybe someone can backport SHA-256 to Firefox 16.
(Score: 4, Informative) by SomeGuy on Friday December 11 2015, @06:07PM
Already done.
Firefox 38.4.0 ESR for Mac OS 10.4 and 10.5 on Mac PPC: http://www.floodgap.com/software/tenfourfox/ [floodgap.com]
(Score: 0) by Anonymous Coward on Friday December 11 2015, @07:49PM
Facebook, "caring" for its users?
Uh, OK...
(Score: 0) by Anonymous Coward on Friday December 11 2015, @11:08PM
Facebook do care about their users, because the number of users affects the valuation of the company. The wrong decision here could lead to a drop in Facebook's monthly unique visitors. Even if investors understand the reason for the decrease, the stock price might suffer.