Forced Conversion: Older Phones May Soon Lose Internet Access

Securing the internet comes at a price.

Hardware companies tend to measure their consumer products in dog years, so it should probably come as no surprise that there are all sorts of warnings about older phones soon losing the capability to access secure sites--roughly 90% of websites.

And by "older phones," they mean phones about five years old.
According to Alex Stamos, the CSO at Facebook, "Facebook's data shows that 3-7% of browsers currently in use are not able to use the newer SHA-256 standard, meaning that tens of millions of people will not be able to securely use the Internet after December 31st."

He then goes on to suggest that this will mostly affect people in developing countries. But if Alex is implying that the only people with older phones reside in "developing countries," he hasn't met anyone with a Blackberry. And it's not just limited to cellphones: essentially anyone with Windows XP or older will run into the same issue if they are browsing with Internet Explorer and not a newer browser. To clarify: it's not that those with older browsers will simply have their internet yanked like pulling a rotary phone from a wall--instead, browsing secure sites will be a virtual impossibility and render having an internet connection almost useless.

The real crux of the issue is that this newer standard is necessary, since the cost of breaking an SHA-1 algorithm has plummeted; now, carrying out a collision attack on a browser using SHA-1 runs around $75,000 to $120,000, which means higher security is vital. Especially because there are exponentially more fake sites masquerading as real ones every day. (For a truly brilliant breakdown of what SHA-1 is versus the newer SHA-256, see this post by Eric Mill.)

Opera? Who's ever used Opera? SSL encryptions soon won't allow SHA-1 users to visit.

Prolonging the migration to SHA-256 would allow for massive security breaches and many, many more vulnerabilities. But that leaves a tricky proposition: alienate a large segment of the population with old browsers or allow for potential collision attacks by terrorists (and that's not alarmist propaganda; it's a very real concern). Sidenote: the EEs' beloved FPGAs can be used to crack SHA-1 hashcodes.

FGPA stack, 1 billion hash per second throughput for the system. Image courtesy Yihua Fang and Xiao Bo Zhao,

Most of us are used to being gently strong-armed into purchasing new phones every two years once the hardware starts supporting software, but that's not a possibility for millions of people.
In this case, the solution is to migrate or be left behind. Even though there have been appeals to extend the deadline, time is out: on January 1st, 2016, everyone with outdated browsers will be shut off from encrypted sites.

The most troublesome part is that this could have been avoided had sites been willing to update their security years ago. But changing certificates is hard and companies were worried that if they began warning visitors about expiring SHA-1 certificates, visitors would assume the entire site was broken and simply not return.


For those of us on the hardware side, the takeaway is simple: do the right thing even when it's difficult or the consequences will catch up and users will pay the price.