SSL is Dead. Long Live TLS.

– Robert Kruger 10 August 2015

We recently deprecated support of an older security protocol – known as SSL version 3.0 – on our web servers because it is a security risk. Security advisors have been recommending this change for several months after the highly publicized "POODLE attack”. Read more here: http://disablessl3.com/

SSL is an encryption layer intended to make communications with web servers secure. Unfortunately, SSL has been compromised and can no longer be trusted. You can read more about SSL and its replacement, TLS, here: https://en.wikipedia.org/wiki/Transport_Layer_Security

Google security advisors first described the POODLE attack in September 2014 (https://www.openssl.org/~bodo/ssl-poodle.pdf) but recognized that many systems relied on SSL to operate. Their recommendation was to eliminate SSL as soon as practical. Here is another general description of the POODLE attack: https://en.wikipedia.org/wiki/POODLE.

Dialogs has completed our systems testing and are now relying on TLS for secure connections to our servers. If your site requires a secure connection, users of older operating systems and web browsers may have difficulty using your website now that SSL has been turned off. Please keep in mind that they are probably experiencing the same difficulties elsewhere on the web. Users of all but the oldest systems may be able to follow the instructions here: http://disablessl3.com/ to resolve the issue.

If your company hosts your website with Dialogs, you may request that we roll back to the support of SSL 3.0 for your site. If you choose to continue to include SSL 3.0 on your site, we will not provide warranty support for the resolution of any issues related to SSL-related security breaches.