Hacker News Reader

Comment by atesti | Hacker News Reader

To me it sounds like reenabling the fallback with trying TLS1.2 after TLS1.3 fails for a connection would be the best solution to gradually upgrade all devices.

View on HN

The article says "Browsers did not want to re-enable the insecure downgrade and fight the uphill battle of oiling the protocol negotiation joint again for the next half-decade." So I guess the natural solution to that is making the TLS protocol a User-Agent-esque nightmare of compatibility patches and pretending to support something you don't which surely WONT come back to bite them in the ass years down the line...

1.2 is still secure. This downgrading/oiling is simple and works for all future versions.

TLS is already so complex and ASN.1 makes xml look like c-struct. This begs the question: why would anyone want to make a crypto overly complex ?

This is exactly what they are trying to avoid. Read the article and you will see this thinking is how the POODLE attack happened.

Yes, I read it, but I think a clean new TLS 1.3 with that old retry fallback system like before would still have been the best solution to establish TLS 1.3 without breakage. Poddle was solved by SCSV and this could be part of TLS 1.3 again, but even a desaster that makes us turn off TLS 1.2 5 years from now is a "good" solution because then the middleboxes have been upgraded.

Why do you assume that the middleshits would get upgraded?

If fallback works, fallback works. End of story. 80% of operators (governments, corporations, soho setups) will explicitly prefer not touching things if at all possible. They won't fix their "not broken" network.

Reply on news.ycombinator.com