Browsers to block access to HTTPS sites using TLS 1.0 and 1.1 starting this month
More than 850,000 websites still use the old TLS 1.0 and 1.1 protocols, scheduled to be removed from most major browsers later this month.
This includes websites for major banks, governments, news organizations, telecoms, e-commerce stores, and internet communities, according to a report published today by UK technology firm Netcraft.
All the 850,000 websites use HTTPS, but on a version that weak. The websites support HTTPS connections via cryptographic certificates built on the TLS 1.0 and TLS 1.1 protocols. These are ancient protocols, released in 1996 and 2006, respectively. The protocols use weak cryptographic algorithms and are vulnerable to a series of cryptographic attacks that have been disclosed over the past two decades, such as BEAST, LUCKY 13, SWEET 32, CRIME, and POODLE. These attacks allow attackers to decrypt HTTPS and access a user's plaintext web traffic.
