Support for TLS 1.0 was disabled in the Community

[doug@ebay]

There was a recent post about TLS 1.0 support in the Community. We always recommend use of the latest browser version of your choice, so don't be concerned if your browser is up to date.

What is TLS? Here's a nice quick definition from Computerworld:

"TLS is the protocol invoked under the covers when viewing secure websites (those loaded with HTTPS rather than HTTP). There are multiple versions of the TLS protocol, and the most recent version, 1.2, is the most secure."

Support for TLS 1.0 was disabled in the Community in January based on requirements from eBay IT and Lithium.  TLS 1.1 and 1.2 are still supported. 

 For the best possible experience, we recommend using one of the following browsers. Unless otherwise stated, browser versions reflect the latest stable release version:

Desktop Browsers
Windows (Version 7+)

Chrome

Firefox

Internet Explorer 11

Microsoft Edge

Mac (Version 10.11+)

Safari
Chrome
Firefox

Mobile Browsers
Android (Version 4.4+)

Chrome

iOS (Version 10+)

Safari

From Lithium documentation:

"Early in 2017, we will be shifting away from the dated Transport Layer Security (TLS) 1.0 protocol to meet industry standards. TLS 1.0 is not as secure as other available options and is no longer supported by the major browser providers. If your community uses TLS 1.0, review your client-side setup to ensure you’re using the latest version of TLS to avoid any potential complications from the protocol being sunset with this release. With the end of support for TLS 1.0, we no longer support the Internet Explorer 10 browser. If you have any questions, contact Lithium Support."

[mallontown]

---

wrote:

There was a recent post about TLS 1.0 support in the Community. We always recommend use of the latest browser version of your choice, so don't be concerned if your browser is up to date.

What is TLS? Here's a nice quick definition from Computerworld:

"TLS is the protocol invoked under the covers when viewing secure websites (those loaded with HTTPS rather than HTTP). There are multiple versions of the TLS protocol, and the most recent version, 1.2, is the most secure."

Support for TLS 1.0 was disabled in the Community in January based on requirements from eBay IT and Lithium.  TLS 1.1 and 1.2 are still supported. 

 For the best possible experience, we recommend using one of the following browsers. Unless otherwise stated, browser versions reflect the latest stable release version:

Desktop Browsers
Windows (Version 7+)

Chrome

Firefox

Internet Explorer 11

Microsoft Edge

Mac (Version 10.11+)

Safari
Chrome
Firefox

Mobile Browsers
Android (Version 4.4+)

Chrome

iOS (Version 10+)

Safari

From Lithium documentation:

"Early in 2017, we will be shifting away from the dated Transport Layer Security (TLS) 1.0 protocol to meet industry standards. TLS 1.0 is not as secure as other available options and is no longer supported by the major browser providers. If your community uses TLS 1.0, review your client-side setup to ensure you’re using the latest version of TLS to avoid any potential complications from the protocol being sunset with this release. With the end of support for TLS 1.0, we no longer support the Internet Explorer 10 browser. If you have any questions, contact Lithium Support."

---

So are you saying that Lithium said early 2017 and its just happening now early 2018?

[doug@ebay]

@mallontown, according to Lithium documentation I quoted, Lithium began "shifting away" from TLS  1.0 in early 2017.  I'm not sure of the exact date Lithium stopped supporting TLS 1.0. The requirement from eBay IT that we stop supporting cane in late 2017, and we implemented the change in January 2018.

---

wrote:

---

---

So are you saying that Lithium said early 2017 and its just happening now early 2018?

---

[berserkerplanet]

Thanks for the detailed reply and confirmation Doug.

[berserkerplanet]

The change happened around 2/6/18 Last post I can find I made with FF3.6.24 browser with only TLS 1.0 was 2/5/18, and sometime after that that browser couldn't connect (was away from desktop for a day or 2)

Other than to myself and 4.5 others sticking with old browsers the timing likely doesn't matter since TLS 1.0 was probably a fallback, the majority would have already been connecting with TLS 1.1, and what happened recently was dropping of support for TLS 1.0 I'm guessing on this as I have no data on my machine to prove that assertion and couldn't find any evidence to prove it on the interwebs

(evidence would be that one of the major browsers disabled TLS 1.0 by default in the past, which would have caused audible howls from those who couldn't connect to the forums with TLS 1.1 if it weren't supported at the time. It looks like all still support TLS 1.0 by default, but some like Chrome may not support certain fallback modes)

Doug's post implies the above is the case, and that support for TLS 1.0 was just legacy in addition to use of TLS 1.1 (and maybe 1.2, and maybe even TLS 1.3)