Difference between revisions of "HTTPS/Browser Recommendations"

From Wikitech-static
Jump to navigation Jump to search
imported>Emufarmers
("This means that if you use an old web browser, you can still read pages on Wikipedia, but your browsing activity cannot always be encrypted in a secure way." is no longer accurate, as written, with the latest deprecation, so I'm removing it; these paragraphs should probably be reworked more generally, though, to align with the new policy)
imported>Þjarkur
(Rewrite intro to match the 2020 TLS deprecation. Move unnecessary explanatory notes of Microsoft support to notes (not of interest to the reader). Generally trying to make the relevant links more prominent, could be made more prominent. Someone who knows more about the 2020 deprecation could maybe improve this page.)
Line 1: Line 1:
== Network Security Matters ==
<div style="float: right;clear: right;width: auto;background: none;padding: .5em 0 .8em 1.4em;margin-bottom: .5em; ">__TOC__</div>
If you're reading this web page, that means [[:en:HTTPS|HTTPS]] is working on your computer or mobile device. However, that's just a first step. Many older computers, mobile devices and/or web browsers only support outdated cryptographic methods that are becoming insecure in the face of modern attacks.


Following the advice below will help you to make sure that you are using the best HTTPS cryptographic methods available today.
Wikimedia encourages its readers to use modern [[:en:web browsers|web browsers]] which support secure internet connections. Below are recommendations for how to update to a modern web browser.


In the future, Wikimedia may require stronger minimum levels of cryptographic abilities from your computer or mobile device in order to access our sites like '''Wikipedia'''. Many other sites on the Internet are (or will be) doing the same. Keeping up-to-date with security updates from web browsers and operating systems will be essential for staying secure and continuing full access to all websites on the Internet.
Many older computers, mobile devices or web browsers only support outdated cryptographic methods that are becoming insecure in the face of modern attacks. Wikimedia will no longer support these outdated cryptographic methods to ensure security against eavesdropping and interferance ([[:en:man-in-the-middle attack|man-in-the-middle attack]]s). Many other sites on the Internet also require (or will require) a strong minimum levels of cryptographic abilities from your computer or mobile device. Keeping up-to-date with security updates from web browsers and operating systems will be essential for staying secure and continuing full access to all websites on the Internet.


== Advice ==
== Advice ==
=== For all users ===
=== For all users ===
* Please make sure you have applied the latest security updates to your Operating System and Web Browser. Remember that for most browsers and devices, they will only be updated after you fully close them and restart them.
* Please make sure you have applied the latest security updates to your operating system and have updated your web browser. Remember that for most browsers and devices, they will only be updated after you fully close them and restart them.
* Disable (or uninstall) any 3rd party "Anti-Virus" software.  Most of them do more harm than good when they interfere with your browser's secure connections.<ref>http://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html</ref><ref>https://jhalderm.com/pub/papers/interception-ndss17.pdf</ref>
* Disable or uninstall any 3rd party "anti-virus" software.  Most of them do more harm than good when they interfere with your browser's secure connections.<ref>http://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html</ref><ref>https://jhalderm.com/pub/papers/interception-ndss17.pdf</ref>
 
=== For users of Microsoft Windows ===
=== For users of Microsoft Windows ===
*'''Windows XP'''
* '''Windows XP'''
** '''If you ''must'' use Windows XP, [https://www.mozilla.org/firefox/organizations/all/ install and use Firefox 52 ESR instead of Internet Explorer] to access our sites'''
** If you must use Windows XP, [https://www.mozilla.org/firefox/organizations/all/ install and use Firefox 52 ESR instead of Internet Explorer] to access our sites.<ref group="n">Our sites no longer allow pageviews from IE-on-XP at all, other than a few minor exceptions like Wikitech itself, the site you're reading now.</ref>
** '''Our sites no longer allow pageviews from IE-on-XP at all''' (other than a few minor exceptions like Wikitech itself, the site you're reading now).
** If possible, please upgrade to Windows 7 or higher, or any other operating system available. Windows XP has very serious security flaws.{{#tag:ref|Microsoft ended all technical support for this system version in 2014.<ref name="windows-lifecycle-fact-sheet">https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet</ref> Microsoft provides no more security updates for the many flaws which have been discovered in Windows XP and its version of Internet Explorer after 2014.
** If possible, please upgrade to Windows 7 or higher, or any other operating system available. Windows XP has '''very serious security flaws'''. Microsoft ended all technical support for this system version in 2014. <ref name="windows-lifecycle-fact-sheet">https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet</ref> Microsoft provides no more security updates for the many flaws which have been discovered in Windows XP and its version of Internet Explorer after 2014.
 
** ''Update 2017-08-17:'' More-detailed technical information about removal of IE-on-XP support from our projects by 2017-10-17 is available at [[HTTPS/3DES_Deprecation]]
More-detailed technical information about removal of IE-on-XP support from our projects by 2017-10-17 is available at [[HTTPS/3DES Deprecation]]|group="n"}}
*'''Windows Vista''' - Microsoft no longer supports Vista, and does not provide security updates since April 2017<ref name="windows-lifecycle-fact-sheet"/>.
* '''Windows Vista'''
**Advice is the generally the same as XP: You should upgrade to Windows 7 or Windows 10.
** If you must use Windows Vista, install and [https://www.mozilla.org/en-US/firefox/organizations/all/ '''use Firefox 52 ESR''' instead of Internet Explorer] to acces our sites.
**If you cannot upgrade, your best option is to install and [https://www.mozilla.org/en-US/firefox/organizations/all/ '''use Firefox 52 ESR''' instead of Explorer].
** You should upgrade to Windows 7 or Windows 10.<ref group="n">Microsoft no longer supports Vista, and does not provide security updates since April 2017.</ref>
*'''Windows 7 through 10'''
* '''Windows 7, Windows 8, and Windows 10'''
**Internet Explorer 11 is the '''only''' version of IE that is currently supported by Microsoft. There are no security updates for Internet Explorer 10 and older versions, since 2016.<ref>https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support</ref> These earlier versions also do not have modern HTTPS capabilities. It is highly recommended that you either upgrade to Internet Explorer 11, or the '''[https://www.microsoft.com/en-us/windows/microsoft-edge Microsoft Edge]''' browser.
** You should upgrade the '''[https://www.microsoft.com/en-us/windows/microsoft-edge Microsoft Edge]''' browser or switch to a different browser such as [https://www.mozilla.org/en-US/firefox/new/ Firefox], [https://www.google.com/chrome/browser/desktop/ Chrome], or [https://www.opera.com/ Opera].
**On IE11 for Windows 7, there is a checkbox to "Enable TLS 1.2" under <em>Internet Options -> Advanced -> (Security section)</em>
** You can use Internet Explorer 11 on Windows 7, but you might need to open Settings and click the checkbox to "Enable TLS 1.2" under <em>Internet Options -> Advanced -> (Security section)</em>
**Alternatively, you can install and use a different browser: [https://www.mozilla.org/en-US/firefox/new/ Firefox], [https://www.google.com/chrome/browser/desktop/ Chrome], or [https://www.opera.com/ Opera].
** Please also ensure you stay up-to-date on security updates from Windows Update, and ensure you regularly upgrade your alternative browser if applicable.
**Please also ensure you stay up-to-date on security updates from Windows Update, and ensure you regularly upgrade your alternative browser if applicable.


=== For users of Apple Mac OS X ===
=== For users of Apple Mac OS X ===
Line 29: Line 29:


=== For users of Apple iPhone, iPad, and iPod ===
=== For users of Apple iPhone, iPad, and iPod ===
Upgrade to iOS version 9 (or higher) [[:en:IOS_9#Supported_devices|if supported on your device]]. If your device is too old for iOS 9, consider a device upgrade. Check to ensure you have the latest version of whatever browser you may use in the App Store.
Upgrade to iOS version 9 (or higher) [[:en:IOS 9#Supported devices|if supported on your device]]. If your device is too old for iOS 9, consider a device upgrade. Check to ensure you have the latest version of whatever browser you may use in the App Store.


=== For users of Android devices ===
=== For users of Android devices ===
Upgrade to the latest version of Android that is possible for your device. Consider a device upgrade if your Android software cannot be upgraded to at least [[:en:Android_KitKat|version 4.4]], which was initially released by Google in 2013. Check the Play Store (or vendor-specific app store) to ensure you've installed the latest updates to core components and the browser (usually Chrome).
Upgrade to the latest version of Android that is possible for your device. Consider a device upgrade if your Android software cannot be upgraded to at least [[:en:Android KitKat|version 4.4]], which was initially released by Google in 2013. Check the Play Store (or vendor-specific app store) to ensure you've installed the latest updates to core components and the browser (usually Chrome).


=== For IT personnel that manage outbound Proxy appliances ===
=== For IT personnel that manage outbound Proxy appliances ===
Line 41: Line 41:
You may use an online tester to check which ciphers are supported by your the browser you are currently using, such as the one provided by [https://www.ssllabs.com/ssltest/viewMyClient.html Qualys (SSL Labs)] or [https://cc.dcsec.uni-hannover.de/ the DCSEC research group at Leibniz University Hannover].
You may use an online tester to check which ciphers are supported by your the browser you are currently using, such as the one provided by [https://www.ssllabs.com/ssltest/viewMyClient.html Qualys (SSL Labs)] or [https://cc.dcsec.uni-hannover.de/ the DCSEC research group at Leibniz University Hannover].


==References==
== Notes ==
{{Reflist|group=n}}
 
== References ==
{{Reflist}}
{{Reflist}}


== See also ==
== See also ==
* [[mw:Compatibility#Browsers]]
* [[mw:Compatibility#Browsers]]
__NOTOC__

Revision as of 03:27, 22 December 2019

Wikimedia encourages its readers to use modern web browsers which support secure internet connections. Below are recommendations for how to update to a modern web browser.

Many older computers, mobile devices or web browsers only support outdated cryptographic methods that are becoming insecure in the face of modern attacks. Wikimedia will no longer support these outdated cryptographic methods to ensure security against eavesdropping and interferance (man-in-the-middle attacks). Many other sites on the Internet also require (or will require) a strong minimum levels of cryptographic abilities from your computer or mobile device. Keeping up-to-date with security updates from web browsers and operating systems will be essential for staying secure and continuing full access to all websites on the Internet.

Advice

For all users

  • Please make sure you have applied the latest security updates to your operating system and have updated your web browser. Remember that for most browsers and devices, they will only be updated after you fully close them and restart them.
  • Disable or uninstall any 3rd party "anti-virus" software. Most of them do more harm than good when they interfere with your browser's secure connections.[1][2]

For users of Microsoft Windows

  • Windows XP
  • Windows Vista
  • Windows 7, Windows 8, and Windows 10
    • You should upgrade the Microsoft Edge browser or switch to a different browser such as Firefox, Chrome, or Opera.
    • You can use Internet Explorer 11 on Windows 7, but you might need to open Settings and click the checkbox to "Enable TLS 1.2" under Internet Options -> Advanced -> (Security section)
    • Please also ensure you stay up-to-date on security updates from Windows Update, and ensure you regularly upgrade your alternative browser if applicable.

For users of Apple Mac OS X

Upgrade your operating system to Mac OS 10.11 (El Capitan) or higher if your hardware supports it. If that is not possible, upgrade to the latest Mac OS release available for your computer, and consider installing an alternate secure browser instead of Safari. Such as Chrome, Firefox, or Opera.

For users of Apple iPhone, iPad, and iPod

Upgrade to iOS version 9 (or higher) if supported on your device. If your device is too old for iOS 9, consider a device upgrade. Check to ensure you have the latest version of whatever browser you may use in the App Store.

For users of Android devices

Upgrade to the latest version of Android that is possible for your device. Consider a device upgrade if your Android software cannot be upgraded to at least version 4.4, which was initially released by Google in 2013. Check the Play Store (or vendor-specific app store) to ensure you've installed the latest updates to core components and the browser (usually Chrome).

For IT personnel that manage outbound Proxy appliances

Please ensure you are running the latest stable software release from your vendor, and that you keep up with this regularly. Please also consult your vendor and/or their documentation as to how you may need to configure your outbound proxy to support stronger TLSv1.2+ encryption with Forward Secrecy and AEAD ciphers.

Logs for Wikipedia have indicated that there are many requests from corporate desktop browsers that meet the version requirements of operating system, web browser, and device - but still suffer from downgraded cipher choice when communicating over the Internet due to outdated or poorly configured outbound proxies.

You may use an online tester to check which ciphers are supported by your the browser you are currently using, such as the one provided by Qualys (SSL Labs) or the DCSEC research group at Leibniz University Hannover.

Notes

  1. Our sites no longer allow pageviews from IE-on-XP at all, other than a few minor exceptions like Wikitech itself, the site you're reading now.
  2. Microsoft ended all technical support for this system version in 2014.[3] Microsoft provides no more security updates for the many flaws which have been discovered in Windows XP and its version of Internet Explorer after 2014. More-detailed technical information about removal of IE-on-XP support from our projects by 2017-10-17 is available at HTTPS/3DES Deprecation
  3. Microsoft no longer supports Vista, and does not provide security updates since April 2017.

References

See also