In Firefox by default support for TLS 1.0 and TLS 1.1 protocols (the security.tls.version.min setting is set to 3, establishing TLS 1.2 as the minimum version). TLS 1.0/1.1 support is planned to be disabled in stable releases in March 2020. Support for TLS 1.0/1.1 will be discontinued in Chrome 81, expected in January 2020.
The TLS 1.0 specification was published in January 1999. Seven years later, an update, TLS 1.1, was released with security improvements related to initialization vector generation and padding. The IETF (Internet Engineering Task Force), which develops Internet protocols and architecture, is currently involved in this.
draft specification that classifies TLS 1.0/1.1 protocols as deprecated. According to the service as of September 3, 95.8% of websites supporting secure connections are compatible with TLS 1.2, while TLS 1.3 is supported by 17.7%. Connections using TLS 1.1 are allowed by 75.5% of HTTPS sites, and TLS 1.0 by 65.5%.
The primary issues with TLS 1.0/1.1 are the lack of support for modern ciphers (e.g., ECDHE and AEAD) and the requirement to support older ciphers, whose reliability in today's computing environment is questionable (e.g., support for TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA is required, with MD5 and SHA-1 used for integrity and authentication). Support for deprecated algorithms has already led to the emergence of attacks such as
, , , and . However, these issues were not directly vulnerabilities of the protocol and were addressed at the implementation level. The TLS 1.0/1.1 protocols themselves do not have critical vulnerabilities that can be exploited for practical attacks.
Source: opennet.ru
