Microsoft calls time on ancient TLS in Windows, breaking own stuff in the process

Re: protocols were disabled by default

For enterprises I'd be a little more concerned...

I would hope, but don't expect, that enterprise systems would properly segment the network so such legacy TLS systems are not facing the world or those machines used for web/email access.

Re: protocols were disabled by default

The problem is that the people holding the purse strings don't seem to understand that these things happen in a way that you, the techie, can't control.

Give them a choice of not being secure while using WAN services vs. not being able to talk to that piece of legacy hardware that you've been asking to replace for years but they won't stump up the money, and they will choose internet security, and expect you to just fix it!

Fortunately, where I am (which is actually quite a sensitive environment), it finally looks like they will finally fund the replacement of the tape libraries and management consoles that are running code so old it's fallen off the suppliers compatibility matrix!

Hopefully.

Pretty Please?

Re: protocols were disabled by default

But it's the enterprises that have "critical" software that's not been touched for decades :-)

Re: protocols were disabled by default

In a similar boat. I recommend disabling encryption (but making software listen localhost only (and enforced by firewall)) and then using i.e stunnel (or with some fiddling, openssh) to create secure tunnels between them which act like "proxies".

In some ways I am considering doing this for more recent installs too in order to allow configuration of certificates in one central location rather than individual daemons.

Most of us don't have the luxury of working only with up to date kit. I provide support for certain devices that are still tied to security standards common in the IE era. They aren't public facing but still critical. Unfortunately there's never the budget to rip and replace apparently, since they "still work".

There's a reason we commonly curse out management and bean-counters on here.

Who the hell relies on early TLS still?

Per the article, people using SQL Server 2016.

This won't affect me. Our SQL Server 2000 on Win 2000 won't be updated by this change. Running on a private network, with 3 automation clients.

Personally, I just wish that web sites using TLS would just switch to HTTP. That would solve all my TLS problems.

IISCrypto in Best Practice mode leaves TLS1.0 and TLS1.1 protocols switched on. Both Server and Client protocols.

Outdated client protocols being used between internal servers is not a problem. This is just another unsubtle nudge from Microsoft to get the chequebook out. If it was really security they are concerned about, then they would add TLS 1.3 to Server 2016.

As the article stated, many versions of SQL server will break hard from my testing.

My application doesn't officially support newer versions of SQL server. So, its either run unsupported SQL version and hope it works 100% correctly, keep the old version, and disable Microsoft's force changes, or replace the whole thing at some unknown cost, and unknown amount of migration and dev work.

In my testing, Microsoft's TLS patches for SQL don't work reliably. The only fix is to do major version upgrades.

I've also got old network devices online. They right now have their management links isolated, but now we'll have to keep out-of-date desktops around so that they can still be managed.

Rip and replace is the only option. Otherwise, operationally they work totally fine for our needs. Its not a security application, but just because the UI was written long ago the whole thing needs to be tossed.

I have to use the web interface of old printers for troubleshooting. Many don't support "modern" encryption. I had to enable TLS 1.0 in Win10 and use IE mode in Edge (not allowed to install another browser per IT) to be able to talk to them. As another poster said, not everyone has the luxury of working with up-to-date equipment. Why should we replace a bunch of fully-functional, relatively cheap to maintain printers just because they use an old protocol? Especially since the replacements break more often and are more expensive to maintain. They're already behind a firewall anyway.

Now if only we could get corporate to update that one bit of operation-critical software, used daily by a huge number of us, that only works with SMB 1.0 (I wish I was making that up).

Re: "low enough to act"

No Microsoft want to force them old sql servers to buy new licenses.

WHy do people fail to appreciate big corp only wants your money,... the answer is always more money.

Re: Our experience: Problems are rare

The usual issue is bits of old hardware with some sort of web interface, like UPS or CNC hardware, or at home a perfectly good NAS from a good few years back. They are a problem and need steps to allow older TLE to work.

Re: Our experience: Problems are rare

Have you tested SQL 7 on Windows 2000 yet? Asking for a friend ( I wish!)

Re: This will be fun

There are still mainstream UK banks insisting that you have to do all your millions of pounds of bank transfers via Internet Explorer, so I'm not surprised.

To the point that they just point you at a PDF on their main website which basically says "Get your IT to re-enable it" including "after 30 days the security settings will revert, so you'll have to put them back every 30 days".

So you have to have a smartcard, double-authentication via two separate entities, getting a card is almost as difficult as opening a bank account in the first place because of all the authorisation you have to get, but then you have to plug it into a Gemalto reader for which they will only give you IE plugins to access it (despite Gemalto having Chrome, etc. plugins for everything) and won't support any alternative.

Re: This will be fun

Hey I have a Tier 1 retail customer still fucking about on Windows XP, Windows Server 2003 and SQL2000 in production !!!

Re: This will be fun

Which version of Windows are the ATMs running? From what I've noticed in the past when seeing them reboot they tended to be ancient versions of Windows!

Re: some old Netgear equipment will be stuffed.

I'm assuming you tired the thisisunsafe trick to force the page to display?

Re: some old Netgear equipment will be stuffed.

I recently retired my ancient ReadyNas NV+ partly for this reason... that and the fact that the internal PSU (the second in it's lifetime) was starting to get a bit "wobbly".

What a loud of crap, ceos dont know shite, they wouldnt be aware of these sorts of real issues.

However ou can be sure someone in a lower department figured this is a good enough way to force upgrades to a new SQL server license.