Re:MaxCDN to drop TLS 1.0 (used by 60% of Android users)
by mtmail on Saturday March 12, 2016 @09:42PM
(#11275890)
Can we remove anything in brackets in the "MaxCDN drops TLS 1.0 (and 60% of Android users on" title? The article doesn't mention Android. The submitter should have added that as a comment, preferably with reference, instead.
[ Parent
| on HN ]
Re:MaxCDN to drop TLS 1.0 (used by 60% of Android users)
by feross on Saturday March 12, 2016 @10:19PM
(#11276031)
It might not be mentioned in the article, but it is fact. Android 4.0-4.4 market share is 60%, according to http://www.appbrain.com/stats/top-android-sdk-versions
Re:MaxCDN to drop TLS 1.0 (used by 60% of Android users)
by tdondich on Saturday March 12, 2016 @10:32PM
(#11276067)
Hi feross. Please note that Android 4.4.2 (KitKat) does support TLS 1.2. As you can see at http://www.appbrain.com/stats/top-android-sdk-versions (A good gauge of android distributions), KitKat is the most used Android distribution, followed by 5.0 (Lollipop).
So, the actual percentage you are looking at is ~25%, but that's also for the native Android browser. Note that the API kits for these versions actually DO support TLS 1.2, when you look at the documentation for http://developer.android.com/intl/zh-cn/reference/javax/net/.... , you can see this is supported in SDK 16+ so custom apps most likely already use TLS 1.1+.
Now, we know this is hard. We know some users will be impacted by this; however, this is how security moves forward. We will continue to monitor our customers and work with them hand in hand to make sure the transitions are as smooth as possible.
Re:MaxCDN to drop TLS 1.0 (used by 60% of Android users)
by tdondich on Saturday March 12, 2016 @10:36PM
(#11276072)
The support matrix for TLS can be found at: https://www.ssllabs.com/ssltest/clients.html