News for hackers. Stuff that matters.
Re:Germany wants smartphone makers to offer 7 years of softw... by iso1631 on Monday September 06, 2021 @01:01PM (#28435706)
Weren't phones in 2014 using TLS 1.2? It was specified in 2008.
Re:Germany wants smartphone makers to offer 7 years of softw... by CodesInChaos on Monday September 06, 2021 @01:50PM (#28436195)
TLS adoption has been surprisingly slow historically. I don't know if any phones were affected. But .net on Windows 7 ran into issues with TLS deprecation (TLS 1.2 was disabled by default). And I think Windows update on Windows 7 and/or 8 broke due to upgraded certificate hashes.
Re:Germany wants smartphone makers to offer 7 years of softw... by pvorb on Monday September 06, 2021 @01:16PM (#28435854)
Sure, but if you deprecated TLS 1.2 today, you'd have to make sure that all devices that are less than 7 years old will get the update.
Re:Germany wants smartphone makers to offer 7 years of softw... by iso1631 on Monday September 06, 2021 @01:18PM (#28435876)
Is anyone talking about deprecating TLS 1.2 before 2025? (TLS 1.3 being specified in 2018 )
Re:Germany wants smartphone makers to offer 7 years of softw... by oaiey on Monday September 06, 2021 @01:55PM (#28436251)
TLS standards are deprecated by vulnerabilities not new Features.
Re:Germany wants smartphone makers to offer 7 years of softw... by iso1631 on Monday September 06, 2021 @03:12PM (#28436932)
If phones normally receive say 2 years of updates, any phone built since 2016 - thus eol in 2023, should support it (chrome/firefox were supporting tls 1.3 in 2017) - i.e in the next 18 months.

A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".

Re:Germany wants smartphone makers to offer 7 years of softw... by bbarnett on Monday September 06, 2021 @08:27PM (#28439560)
One thing, sometimes phones are released, but manufactured for 2 or 3 years, plus sit on store shelves for a year after that.

Today, you can often find such new phones on sale, yet already? No security updates. End of support.

So the life of a phone model before you even buy it new, may be years...