Browser makers cite coronavirus, restore support for obsolete TLS 1.0 and 1.1 encryption

Google, Microsoft and Mozilla have each issued reprieves to Transport Layer Security (TLS) 1.0 and 1.1, aged encryption protocols that were to be bounced from browser support in March, because of the COVID-19 pandemic.

By common agreement, Google’s Chrome, Microsoft’s Internet Explorer (IE) and Edge, and Mozilla’s Firefox were to disable support for TLS 1.0 and 1.1 early in 2020. They, along with Apple – which produces Safari – announced the move a year and a half ago, noting then that the protocols had been made obsolete by TLS 1.2 and 1.3.

Apple, Google and Mozilla had committed to dropping support in March 2020, while Microsoft had only promised to purge TLS 1.0 and 1.1 sometime during the first half of this year.

But it was Microsoft that was most detailed about the TLS turnabout. “In light of current global circumstances, we will be postponing this planned change – originally scheduled for the first half of 2020,” Karl Pflug, of the Edge developer experience team, wrote in a post to a company blog.

(Microsoft has generally used the “current global circumstances” phrasing or something similar, rather than coming out and saying “COVID-19” or “coronavirus.”)

The plug-pulling of TLS 1.0 and 1.1 will only be delayed, Pflug continued. Edge – the newer, Chromium-based Edge, will reinstitute the banishment “no sooner” than Edge 84, currently slated to release around July 14. The older browsers in Microsoft’s inventory, IE11 and the legacy Edge, will disable the protocols by default as of Sept. 8.

Google will do things differently, even though, like Edge, it’s based on Chromium. Originally, Chrome 81 was to pose an interstitial warning users when they tried to reach a site encrypted with TLS 1.0 and 1.1; that version was supposed to appear March 17, but was postponed three weeks ago.

“Removal of TLS 1.0 and TLS 1.1 has been delayed to Chrome 83, which is expected to ship in late May 2020,” Google said in a document about Chrome feature and API deprecations. Chrome 83 – Google has already said it will skip version 82 – is scheduled to launch May 19.

Meanwhile, Mozilla chimed in, too, with more of an explanation than either of its rivals. Firefox 74, which debuted March 10, had disabled TLS 1.0 and TLS 1.1; sites that didn’t support TLS version 1.2 or greater showed an error page when users tried to reach them.

Mozilla rolled that change all back. “We reverted the change for an undetermined amount of time to better enable access to critical government sites sharing COVID-19 information,” Mozilla said in a revision to Firefox 74’s release notes. Mozilla did not cite examples of the sites it said continued to rely on the older protocols, nor set a timetable for eventually rolling back the roll-back.

Apple has not posted any news about how its Safari will deal with TLS 1.0 and 1.1 during the coronavirus crisis.

Copyright © 2020 IDG Communications, Inc.

Source link

How COVID-19 should change laptop and browser priorities

Disclosure:  Most of the vendors mentioned are clients of the author.

This last week was surprisingly busy, given that most of us are locked in our homes, trying to recall what normal is like. Microsoft announced significant changes with its Chromium Edge browser that significantly addressed the problems we focused on before the pandemic, and both Intel and AMD drove laptop refreshes.

Still, those designs originated from conditions that existed before the Pandemic, not the world that now exists. 

So let’s talk about where I think the next security focus for browsers will be and what laptops post COVID-19 may begin to look like this week.

Browser user protection

The Chromium-based Edge browser is a wonder in that it combines the core code from Google with the unique user-oriented features from Microsoft.  It is my Go-To browser, and these updates include better password management (including Dark Web alerting) and far more aggressive privacy features eliminating tracking and history when needed.  They also include a whole host of productivity features like preserving formatting with copy and past and vastly improved favorites management. 

All of those things are still important. But with the COVID-19 outbreak, another more substantial threat has become far more problematic: false information.

 Atlas VPN research just released a study showing there has been a whopping 1,900% increase in scam websites from February to March – and as of April 2,  35,500 websites were pushing false information and products.  According to VPN Research, Interpol is reporting that people in Europe have been scammed out of $2 million, with individual losses as much as $100,000 each. And this is still just the start. 

So I expect that the next version of Microsoft Edge Chromium will have a feature that helps users identify scam sites and fake news, much as Microsoft addressed the threats from last year with the current release. 

Laptop evolution

The way we worked with laptops before the outbreak is that they generally went to highly mobile people; thus, the emphasis was on size, weight, and battery life, not performance or large screen size. The most common size was, and is, 13 inches, which is great for portability but not that great for productivity.  Now, while road warriors won’t go away, the demand is for a product that gives you a home office with full functionality, that can help you work where you need to be, whether that be in the living room or kitchen while you watch your kids. 

Performance becomes more critical because you’ll probably not only be doing more creative work; you are also going to want to unwind (with games) ­– making performance, screen size, and productivity more important than portability.  I’m going back and forth on battery life because, while that may not be critical in the living room or kitchen, it could be necessary on the patio and to avoid cord trip hazards. 

As I was thinking on this, HP sent over an HP Envy 17; I think it is an ideal configuration for those working from home than a 13-in. laptop.  It has a 17-in.  screen, the 10th Generation Intel Core i7 processor, an NVIDIA GeForce MX330 discrete graphics system, Wi-Fi 6, 124GB of memory, and a 512GB drive.  It does weigh 6 pounds, and the four-cell battery will only give you a few hours of battery life. But that is adequate when you are mostly stationary and are rarely away from a plug. (It also appears to have decent Bang & Olufsen speakers in case you want to drown out the kids.)

Given the current-use model, this design makes more sense to me – though for a future product, I’d want a higher NIT screen so it would work outside better and some cosmetic changes that might make it easier to disinfect.  

I also wonder whether the market would now accept a 21-in. product, given the  changed usage model. For this kind of work-at-home model, a larger screen, more power, and a more easily cleaned format will – if this pandemic goes on for months – become a much more viable option. 

Wrapping up

We are going to see a lot of changes as a result of COVID-19.  I’ve focused on two in terms of browser security focus and laptop design.  We are working very differently, and until an anti-virus exists, most of us will likely still be working from home, avoiding travel, and keeping away from significant events.  I doubt CES 2021 will happen because we aren’t expected to have an anti-virus until at least next February.     

The related behavior changes also suggest that if you are buying a new laptop, you may want to adjust your priorities to take into account your current needs and not buy based on what they might have been the standard before the outbreak.  Consider something more substantial, with more performance over smaller designs because the size of the display does matter, and productivity, not portability, is what pays your bills.   

Copyright © 2020 IDG Communications, Inc.

Source link

Zoom pauses new feature development to focus on privacy, security

Zoom has decided to cease development of new product features so it can focus on fixing various privacy and security issues.

The company has seen a surge in the use of its platform in recent weeks, as self isolation in response to the Covid-19 pandemic ramps up the demand for video software. As its popularity has boomed – both for business and personal use – and the company’s stock price rocketed, underlying vulnerabilities in the platform have become apparent. 

“Zoom-bombing,” where intruders have been able to access video meetings that were not password protected, has led to serious privacy concerns, with uninvited attendees harassing online A.A. meetings and church meetings, for example. The FBI this week warned of unauthorized access to virtual classrooms and recommended that users change security settings to protect meetings. 

Meanwhile, Elon Musk’s SpaceX aerospace company apparently banned the use of Zoom by its 6,000 employees because of privacy and security worries, according to  Reuters. Zoom has also come under fire for a vulnerability that enabled hackers to steal passwords on Windows devices, though that flaw has since been addressed.

Zoom CEO apologizes for recent issues

In response to the growing concerns, Zoom CEO Eric Yuan published a blog post Wednesday detailing the company’s response. He said that over the next 90 days Zoom will direct necessary resources to “better identify, address, and fix issues proactively.

“We are also committed to being transparent throughout this process. We want to do what it takes to maintain your trust,” he said. 

Measures include a “freeze” on feature development, with Zoom engineers told to focus on “trust, safety and privacy issues.”

The company also plans to work with “third-party experts” to review security for consumer use of its platform; create a council of CISOs to discuss security best practices; create a transparency report in relation to “requests for data, records, or content;” expand Zoom’s bug bounty program; and conduct white box penetration tests to identify other security issues. 

Yuan will also host weekly webinars to provide privacy and security updates.  

Zoom needs to prove it’s enterprise-ready

Zoom is going “above and beyond” by putting its roadmap on hold to address recent concerns, said Raul Castanon, senior analyst for workforce collaboration at 451 Research / S&P Global Market Intelligence. “This should help restore confidence with enterprise users, assuming the company comes up with a clear list of improvements after the 90-day period.

“Zoom is getting a lot of attention with the pandemic, and the security issues could actually be an opportunity for the company to prove it can address privacy and security for its enterprise customers,” he said.

However, Zoom still has a way to go in terms of ensuring that its platform is ready for enterprise use.

“Yuan contradicts himself with his comment about Zoom being developed for enterprise customers ‘with full IT support’ and not a ‘broader set of users,’” Castanon said. “It is true that the pandemic is uncovering opportunities for improvement – not just for Zoom, but for most vendors – but the security flaws that have come up show the platform is not quite enterprise-grade. Yuan could have been better off without that remark.”

In another privacy incident, Zoom is being sued in California for sharing user data with Facebook. Zoom said in a March 29 blog post that it “has never sold user data in the past and has no intention of selling users’ data going forward,” and would remove the Facebook SDK (software development kit) from its iOS client, which it said was responsible for collecting device data.

Castanon commended the way Zoom handled privacy issues related to the Facebook SDK.

“Zoom will be okay, but this incident will further damage Facebook’s reputation,” he said. “Mark Zuckerberg should pay close attention to Eric Yuan’s detailed response about how Zoom is addressing security and privacy concerns.”

Copyright © 2020 IDG Communications, Inc.

Source link

Pandemic leads to surge in video conferencing app downloads

Business communication apps saw record levels of growth in March, according to statistics from mobile market data provider App Annie.

With a growing portion of the global population now living under some kind of government lockdown, many organizations have had to shift business processes – and their employees are having to embrace a work-from-home culture on a scale never before attempted.

Not surprisingly, the demand for video conferencing apps has surged in recent weeks, with enterprise-focused mobile app downloads reaching 62 million during the week March 14-21 – the highest number ever seen.

According to a report by App Annie, that figure was up 45% from the week before and up 90% from the pre-Covid-19 weekly download average. Business application downloads represent the highest growth in any category in both the iOS and Google Play stores.

Microsoft Teams and Google Hangouts Meet both jumped in the rankings, with Zoom Cloud Meetings the undisputed winner; it saw large numbers of downloads in the US, UK and across Europe. According to App Annie, during the record-breaking week Zoom was downloaded 14 times more than its 2019 Q4 weekly average in the U.S.; 20 times more in the UK; 22 times more in France; and a staggering 55 times more in Italy. (The higher numbers ae in areas that began lockdowns earlier.)

During the same period, Hangouts Meet saw 30 times the weekly level of downloads compared to the last quarter of 2019 in the U.S., while Teams saw an 11-fold increase..

 “As people face uncertain timelines for the length of social isolation, video conferencing apps have the potential to vastly influence our daily habits — breaking down geological barriers and fostering the ability to work and socialize relatively seamlessly,” said App Annie’s Lexi Sydow in the blog post detailing the app download numbers.

Long-term impact

With President Trump this week announcing that federal coronavirus guidelines will remain in place until at least April 30, the dramatic uptake in video conferencing software use is set to continue.

Tom Eagle, senior research director at Gartner, believes that the COVID-19 crisis will be a “catalyst for transformative work cultures and practices that will be significantly characterized by remote work,” noting that video conferencing will become an indispensable tool for workforce collaboration and communication.

For the last several years, Gartner has forecast that, within the unified communications market, the cloud video conferencing market – which includes platforms such as Cisco Webex, Zoom and Microsoft Teams – will only be outpaced in terms of growth by cloud-based telephony.

“This is a direct result of today’s digital workplace and the changing nature of work – as well as the current COVID-19 crisis — continuing to drive demand for video conferencing at an accelerated pace,” Eagle said.  

Even before the pandemic arrived, research showed the demand for collaboration software and video conferencing tools was already on the rise. According to Gartner’s workforce consumer survey, the average amount of time employees spend in meetings each week has reached 11.7 hours, with 9% of respondents spending more than 20 hours of their working week in meetings.

As businesses grow a more-global footprint, teams are becoming more geographically dispersed, making face-to-face collaboration increasingly difficult. As a result, a more-mobile workforce now requires greater, and more convenient, access to workplace collaboration tools than ever before.

“With the combination of non-routine workforce growth and this workplace meeting profile, corporate real estate and IT planner decisions are often animated toward providing more convenient access to collaboration technologies such as video conferencing,” Eagle said. “They do this not just at the desktop, but in shared spaces such as huddle rooms; access must also be provided for mobile and at-home workers.

“An agile workforce needs all of these options for enhanced productivity.”

Copyright © 2020 IDG Communications, Inc.

Source link

Amazon and Apple TV deal shows how to solve business conflicts

I didn’t see this as an enterprise-focused story at first, but a recent compromise between Amazon and Apple shows how communication can help even opposing businesses solve problems and grow value.

Amazon and Apple make a deal

Amazon this week suddenly began permitting Prime subscribers to access and purchase content from Prime using the iOS app.

To the vexation of many users, this wasn’t possible before. You had to visit Amazon’s site on a computer, purchase the item you wanted, and only then could this be accessed using an iOS device, including Apple TV.

The process was annoying, and was purely driven by the two billionaire multinationals arguing over who would get to keep a share of the purchase price.

Customers suffered to protect the all-important bottom line.

Now this has changed, and it has become possible to access and purchase Amazon’s content via the app. That’s better for any customers out there seeking out some entertainment during lock down. But, like so many of the little things, this arrangement suggests a shift in the way both companies think about their business and how to compete in the streaming media landscape.

Quid pro quo

An investigation by John Gruber shows that the deal kind of works in a slightly more complex way: Not only can you purchase content through Amazon’s iOS app, but you can also now buy Amazon Prime subscriptions through the app.

When you purchase a subscription using an Apple device, Apple gets a cut (presumably 30%) of the deal.

However, if you purchase a Prime subscription on Amazon, this will be honoured.

It goes further, as the support also means:

  • Integration with the Apple TV app.
  • AirPlay 2 support.
  • tvOS apps.
  • Support for universal search, Siri and zero/single sign-on.

In other words, you can more easily access movies purchased from Amazon on Apple TV, stream them from your device to an AirPlay 2-supporting television and also search for things using the Apple remote.

What Apple says

In a statement, Apple explains:

“Apple has an established program for premium subscription video entertainment providers to offer a variety of customer benefits — including integration with the Apple TV app, AirPlay 2 support, tvOS apps, universal search, Siri support and, where applicable, single or zero sign-on. On qualifying premium video entertainment apps such as Prime Video, Altice One and Canal+, customers have the option to buy or rent movies and TV shows using the payment method tied to their existing video subscription.”

What this means

Apple’s note around Altice One and Canal+ is significant.

The company has been working with some cable service suppliers to integrate its streaming systems with others. In Portugal, for example, the Apple TV is provided as to those who subscribe to MEO, and ships with MEO content available as an app.

Apple’s move to recognize Amazon as a de facto streaming services provider means it is beginning to recognize the need to work in more complex partnerships with others.

We don’t yet know if this sets the bar for how Apple intends working with others in future, though I do hope it does.

While doing so may slightly reduce the amount of cash Apple claws back on subscription deals for third-party content services, the benefits in terms of customer experience and widened content access are huge.

It is, after all, now pretty clear that Apple’s TV+ service will not defeat any other service out there – it just doesn’t have the content.

Why is this an enterprise-focused story?

I see it as a parable, really.

Apple, Amazon and others are all actively engaged and compete to define the future of television, but that future cannot be a zero-sum game.

The fact that these competitors are finding ways to work constructively together is a salutary lesson, as both benefit from the arrangement, while retaining their own individual identity.

(It’s also potentially a reaction to heightened anti-trust oversight in some territories.)

It seems typical of Apple CEO Tim Cook’s approach to complex challenge.

Describing his work with the current U.S. administration, he has said:

“The way that you influence these issues is to be in the arena. So, whether it’s in this country, or the European Union, or in China or South America, we engage. And we engage when we agree and we engage when we disagree. I think it’s very important to do that because you don’t change things by just yelling. You change things by showing everyone why your way is the best. In many ways, it’s a debate of ideas.”

A willingness to dialog is essential for any business facing any challenge. The Amazon/Apple arrangement shows how even competitors may benefit by reaching around such walls. Particularly when doing so also enables both parties to do a more right thing.

We have to hope other streaming services providers get involved, as once they do then Apple’s TV app on the multitude of devices that support it will become a brilliant (and personalized) way to access all your content. 

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.

Source link