Why You Should Upgrade Your Site To TLS 1.3

As the internet matures, we're seeing more transactions happening online. eCommerce payments such as online shopping, subscriptions, pay per view, pay to play and a host of other confidential information circulating across the web through various websites.

The rise in transactions and private information transfer lead to hacking and phishing scams becoming a rather lucrative venture. As website owners need to assure their customers of their security, new protocols have been created to encrypt and secure data transferred across sites.

One such protocal has been TLS.

The history of TLS

TLS 1.2 has been the standard protocal for over eight years and has done fairly well up until this point, but is by no means perfect. As of August 2018, we saw the release of TLS 1.3 which has steadily made process as sites and hosting providers begin to migrate to the new security layer.

Along with the HTTP/2 protocol update which released in late 2015, and now TLS 1.3 in 2018, encrypted connections are far more secure and faster than ever.

What is TLS?

TLS stands for Transport Layer Security and is the successor to SSL (Secure Sockets Layer). TLS provides secure communication between web browsers and servers.

Symmetric cryptography is used to encrypt the data transmitted on every session making connections far more secure. A unique key is generated for each link with a site. This link is based on a shared secret negotiated at the beginning of the session, also known as a TLS handshake.

TLS 1.3 Browser support

The most significant piece of news in the race towards TLS adoption has been upgraded by popular browsers to now support and even show a preference for sites with TLS connections.

Chrome has been shipping a draft version of TLS 1.3 since Chrome 65. In Chrome 70 (released in October 2018), the final version of TLS 1.3 was enabled for outgoing connections. In 2020 once Chrome launches version 80 it will no longer support the encryption protocols TLS 1.0 and TLS 1.1 and see 1.3 as the preffered option

A draft version of TLS 1.3 was enabled in Firefox 52 and above (including Quantum). They have been retaining an insecure fallback to TLS 1.2 until they knew more about server tolerance and the 1.3 handshakes.

Firefox 63 (released in October 2018) shipped with the final version fo TLS 1.3.

Microsoft Edge started supporting TLS 1.3 with version 76, and it's enabled by default in Safari 12.1 on macOS 10.14.4.

As all primary desktop and mobile browsers start to show a bias to TLS 1.3, we could see it have a knock-on effect for sites who have upgraded and websites who have not. We already saw an example of this as browsers started to show the HTTPS lock for sites with an SSL certificate and I expect something similar in the future.

Benefits of TLS 1.3

Speed

TLS and encrypted connections have always added a slight overhead when it comes to web performance. HTTP/2 helped with this problem, but TLS 1.3 helps speed up encrypted connections even more with features such as TLS false start and Zero Round Trip Time (0-RTT).

TLS 1.2 used two round-trips to complete the TLS handshake while 1.3, it requires only one round-trip, which in turn cuts the encryption latency in half.

Another advantage of is that in a sense, it remembers! On sites you have previously visited, you can now send data on the first message to the server. This recall function is called a “zero round trip.” (0-RTT) which results in improved load time times.

Security

Data integrity is critical to your entire community. TLS 1.3 represents a significant leap forward for security. TLS 1.3 removes all primitives and features that have contributed to weak configurations and enabled common vulnerability exploits like DROWN, Vaudenay, Lucky 13, POODLE, SLOTH, CRIME and more.

TLS 1.3 has also introduced more improvements than any previous version of the protocol. Additional features have been added to enhance the security and robustness of the protocol.

Privacy

Learning from the mistakes of 1.2, TLS 1.3 now offers an extension that encrypts SNI information. When used correctly, this extension prevents attackers from leaking the remote server's domain name, so they have no method of tracking HTTPS user history.

This encryption feature provides greater privacy to Internet users which are sorely needed.

Possible effects of TLS 1.3

Just like with HTTP/2, TLS 1.3 is another exciting protocol update that we can expect to benefit from for years to come. Having better and faster encryption will slowly become the norm. We could see pressure from browsers as well as search engines and social media sites may show a bias to places with higher security measures.

We already know that HTTPS is now an official ranking factor, we already see browsers flagging non-secure sites, so I don't see why TLS won't be seen as valuable trust signal going forward.

Even if it's not a direct ranking factor, the increase in speed will surly help reduce bounce rate and improve your traffic and conversion over time.

I would highly recommend site owners require with their hosting provider or CDN and if they run their servers, to look at upgrading to a TLS 1.3 as soon as possible. If you're unsure about your sites current status, you can run a free TLS test on your site here    

Contact us

If you're still unsure as to which hosting service would suit you, or need to know more about digital marketing for your business, then don’t be shy we’ re happy to assist. Simply contact us

Are you looking to promote your business?

South African Business owners can create your free business listing on nichemarket. The more information you provide about your business, the easier it will be for your customers to find you online. Registering with nichemarket is easy; all you will need to do is head over to our sign up form and follow the instructions.

If you require a more detailed guide on how to create your profile or your listing, then we highly recommend you check out the following articles. 

• How to create a nichemarketer profile 
• How to create a nichemarket business listing 

Recommended reading

If you enjoyed this post and have a little extra time to dive deeper down the rabbit hole, why not check out the following posts on web security.

• Will Hetzner's Security Breach cost them the SA Business Awards?
• How Site Maintenance Improves Website Health?
• Wordpress Blogs Defaced By Hackers

Tags: Web Security