By now you\u2019ve probably heard the exciting news that TLS 1.3 has been released! Oh, you hadn\u2019t? I guess it\u2019s easy to forget that outside of the handful of people who design, sell, market or deploy TLS on a large scale\u2014nobody cares. That may include you. In fact, you\u2019re probably only here because something broke, or you got an error or you\u2019re my boss and you\u2019re checking to make sure I haven\u2019t been sowing insurrection on the internet again.<\/p>\n
Well listen up, as we continue to refine the TLS protocol and release new versions it\u2019s important that you occasionally go through your implementations and disable old and outmoded versions. Consider it like digital spring cleaning.<\/p>\n
You like to live dangerously, do ya? If the internet\u2019s Do-no-Evil overlord, Google, finds out that your server still supports TLS 1.0 it will dispatch its agents to literally drag you out of your bed and summarily execute you in the street. And that\u2019s just for TLS 1.0, heaven forbid your server still supports SSL 3.0, Google may end your entire line, Game of Thrones style\u2014which is usually gory. [Editor\u2019s Note: Carl, this is an article about disabling BROWSER support\u2026]<\/p>\n
Fortunately, you\u2019re not dealing with this issue server-side. That\u2019s a different article. You\u2019re just worried about how to handle things from the browser side. Great question!<\/p>\n
POODLES! No seriously, there\u2019s a threat called POODLE, Padding Oracle On Downgraded Legacy Encryption, which granted POODLE is the acronym, but nothing makes a legitimate threat sound less important than naming it after a bourgeois French dog with a bad haircut.<\/p>\n
Anyway, POODLE is serious. It allows attackers to extract data from a secure connection by forcing it to downgrade to outdated protocols. To avoid this you need to disable support for SSL entirely (and TLS 1.0, too).<\/p>\n
So here\u2019s how to disable browser support for SSL 3.0\u2026<\/p>\n
Google disabled support for SSL 3.0 after version 38. And rather than give you years old instructions on how to disable SSL 3.0 in version 38 or earlier, I\u2019m going to give you a piece of invaluable advice:<\/p>\n
UPDATE YOUR #$%^&!@ BROWSER!<\/p>\n
Stay cautious, my friends\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"