| BCornwall | |
| Jun 17 2024, 9:44 PM |
| F60773669: Screenshot at 2025-05-28 10-19-45.png | |
| May 28 2025, 5:21 PM |
| F60733505: obraz.png | |
| May 28 2025, 1:06 AM |
| F55437989: Screenshot at 2024-06-17 14-47-38.png | |
| Jun 18 2024, 2:47 PM |
| F55415234: Screenshot at 2024-06-17 09-10-47.png | |
| Jun 17 2024, 9:44 PM |
We're interested in deprecating TLS 1.2 in favor of using TLS 1.3. This is a long-term effort rather than an immediate change.
What do we need to do in order to eventually get there?
The last 30 days of traffic, broken down by TLS version
User agent aggregation:
Coordination with mediawiki's compatibility grades will be important here (Updating of Grade A support matrix).
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T380344 Safari support for Modern (Grade A) (proposal for current + 3 previous major versions) | |||
| Open | None | T367821 Discovery: Deprecation of TLS 1.2 |
This will mean Chrome<70 and Firefox<63 users will no longer be able to view Wikimedia projects.
Also, Safari (desktop) only have complete support for TLS 1.3 since Safari 14, released September 2020.
I think you might need to check your stats based on UserAgent (if that is possible). You might need to check with tool and bot authors which might be using outdated software. This is important because a single connection once a day by some tool might be used by thousands of users.
For example with some effort you can support TLS 1.2 as far back as Java 7. It is not possible to do that with TLS 1.3.
I guess most tools should be fairly easy to update, but probably not effortless.
TLS 1.3 is also available in Safari 12.1 and later. Full support in macOS Mojave and later, and iOS.
However, Safari 12/13 on macOS Sierra and High Sierra are not compatible with TLS 1.3.
Let's give a update to market share:
These browsers listed (0.50% total) don't support TLS 1.3.
Usually better to use our own stats.
Which my offline calculator puts at 1.488% total unsupported and another 0.309% mixed support (excluding the bots). Including the estimated bots adds another 0.306%. So potentially around 2% of traffic not supporting TLS 1.3. Plus Other and Redacted are in the realm of 0.6% which we don't (other) and can't (redacted) know details of. (I totally ignored all the smaller browsers which looks to be another 0.01% or so in relevant ranges. Yandex 0.004%, Chrome Mobile Webview 0.007%.)
TLS 1.3 is not as big of a issue for Android as with iOS.
Chrome 71 and Firefox 68 (both released 5 years ago) are compatible with Android 4.1 and above. These browsers support TLS 1.3.
Android 4.1 is 12 years old. However, iOS Safari 10-11, which are 7-8 years old, don't support TLS 1.3. Apple only managed to implement TLS 1.3 in iOS Safari 12.2, which is six years old.
@RhinosF1 was kind enough to do some investigation for AutoWikiBrowser/Windows. .NET applications (including AutoWikiBrowser) on Windows 10 do not support TLS 1.3 by default.
There's also this chart detailing Windows support: https://learn.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-
And this chart detailing .NET support: https://learn.microsoft.com/en-us/dotnet/framework/network-programming/tls
AutoWikiBrowser users have reported issues connecting to meta.miraheze.org, which has recently switched to TLS1.3-only.
Shall this task be stalled then? Many computers still use Windows 10, which still lacks TLS 1.3 support, and have yet to be upgraded to or replaced with Windows 11 or the Win 11 successor. We can revisit this when Windows 10 loses most of its market share by then.
This only affect 3rd party tools like AWB, not Edge browser which is based on Chromium. Also, Windows 10 will be EOL later this year.
FYI from the edge TLS stats POV (the first graph in the description), if we ignore the null results and just look at TLSv1.2 / (TLSv1.2 + TLSv1.3), in the ~year since this ticket was created: the TLSv1.2 percentage has dropped from ~3.76% to ~2.78%. We still have quite a ways to go before we reach a comfortable number even in that simplistic analysis.
This only affect 3rd party tools like AWB, not Edge browser which is based on Chromium. Also, Windows 10 will be EOL later this year.
Not sure how this works for Wikipedia audiences, but I imagine schools in India—and frankly, in most countries—won't update any time soon. Same for many computers like laptops bought during pandemic for children.
I can say for sure that many libraries in Poland are still stuck on Windows 7. This is fresh stats from 2025:
Browsers do support TLS 1.3 even on Windows 7, but if we're talking about systems, then EOL is actually not a good thing for us. I've seen Windows XP both with my own eyes and in stats long after it reached EOL.
