Digital divide widens as the Web adopts stronger encryption standard

On New Year's Day, a change meant to strengthen online security will have the inverse effect, too, leaving millions of users' Web traffic completely exposed.

Microsoft, Google, and Mozilla will start phasing out older Internet encryption in Edge, Chrome, and Firefox browsers in favor of a newer, more secure standard. The aim is to get websites to adopt a beefier security method for ensuring private communications and safe bank transactions over the Internet.

But Web browsers that haven't been updated in the past few years or older generations of many mobile devices, which are commonplace in much of the developing world, will be unable to use the updated encryption standard. That means that many of those users will lose access to online functions protected by the Web protocol called Secure HTTP, or HTTPS.

Losing HTTPS access will put users at risk from hackers and digital thieves, says Kurt Rohloff, an associate professor of computer science at the New Jersey Institute of Technology. It will also block one of the simplest ways of avoiding online surveillance and censorship.

That's especially concerning because older phones are common in many countries with the highest levels of online censorship, says Mr. Rohloff. "If they’re basically forced to use these older devices, they won’t be able to protect themselves from local governments that would be snooping on their communications."

Insecure mobile access is a bigger concern in developing countries where many people depend on their phones to access the Web, sats Joseph Bonneau, a tech fellow at the Electronic Frontier Foundation (EFF). "Of course, for many users they only have Internet access through their mobile devices, so insecurity of mobile browsing means insecurity of all of their browsing," he said in an e-mail.

It is difficult to find hard data on the number of older smartphones in developing markets that could be affected by the change. Somewhere between 3 and 7 percent of Web browsers in use around the world cannot use the newer HTTPS standard, according to Facebook. Smartphones more than six or seven years old, ones that haven't been updated properly and many "dumb phones" with basic Web browsing functions will also be affected.

"A disproportionate number of those people reside in developing countries, and the likely outcome in those counties will be a serious backslide in the deployment of HTTPS by governments, companies and NGOs that wish to reach their target populations," Facebook’s chief security officer, Alex Stamos, wrote in a blog post earlier this month.

In many African countries, for instance, cellphones take the place of banks as well as desktop computers, with usage of mobile money – and mobile cons – widespread. Phasing out the older encryption standard could leave those users even more exposed, experts worry.

HTTPS has become the standard for online banking and commerce. Recent concerns about data breaches and government surveillance have also made it increasingly popular across the Web – from social media to online news to the federal government.

Here's how it works: After some verification, a certificate authority uses an encryption algorithm to sign a digital certificate for a website that wants to use HTTPS. When a user connects to the site, their browser examines that certificate and, if it checks out, establishes a secure connection. The user then has some assurance that the site is what it says it is, and that the content of their communication with the site is encrypted. Most Web browser show a lock icon or a similar indicator in the address bar for HTTPS sites.

As computers have become more powerful and less expensive, experts have worried that it might soon be affordable to fake HTTPS signatures that use an older encryption algorithm, called SHA-1. In 2012, cryptography experts Jesse Walker and Bruce Schneier estimated that SHA-1 forgeries could be within the reach of organized crime by 2018. The cheap availability of cloud computing has moved that timeline up dramatically. 

In response, Microsoft, Google, and Mozilla all announced earlier this year that their products will start phasing out support for HTTPS certificates created using SHA-1 starting Jan. 1, 2016.

After Jan. 1, websites that use SHA-1 encryption will appear increasingly less secure when viewed on Microsoft, Google, and Mozilla products. The companies are considering ending all support for SHA-1 by next summer. People who visit websites secured by SHA-1 certificates after the cutoff date will get an error message saying the site is insecure.

"We will continue to coordinate with other browser vendors to evaluate the impact of this timeline," Kyle Pflug, program manager for Microsoft Edge, wrote in a blog post last November.

Websites are responding in kind. The percentage of popular websites using SHA-1 certificates has declined 55 points in the past year – from almost 71 percent last December to just under 16 percent this month, according to monthly surveys by the Trustworthy Internet Movement.

"Most servers will have to switch, because having that warning shown is bad for business. They will switch to SHA-256, which is the replacement for SHA-1," Mr. Bonneau of EFF explained. "But some really old clients won't accept SHA-256 certificates. So they will show a security error when a server presents a new, SHA-256 certificate since they don't understand it."

Many older devices will be able to handle SHA-256 certificates without problem. Apple added SHA-256 support to the iPhone in 2009, according to data compiled by the certificate authority GlobalSign. Google’s Android platform has supported SHA-256 from the beginning, with improvements in 2009 and 2010. BlackBerry added support in 2011. 

The main problem is with older smartphone platforms, experts said, and with custom versions of Android released by manufacturers and carriers who fail to push security updates. Earlier this year, researchers at the University of Cambridge found that 87 percent of Android phones have critical vulnerabilities caused by manufacturers not updating them properly.

"Unfortunately Google can only do so much, and recent Android security problems have shown that this is not enough to protect users," Alastair Beresford, the lead researcher, said in a statement. "Phones require updates from manufacturers, and the majority of devices aren't getting them."

Still, there are workarounds for platforms that cannot use SHA-256, according to Guevara Noubir, a computer science professor at Northeastern University and an expert on wireless networks.

Mozilla is working to make the download page for its popular Web browser, Firefox, available to both people on older browsers that can’t use SHA-256 and people on newer ones that won't use SHA-1. The hope is that people on the older browsers will stop using them once they’ve downloaded Firefox, which is fully compatible with SHA-256.

Meanwhile, the Web content delivery company CloudFlare has proposed a system to let the same website serve different certificates to different devices – a move supported by Facebook, which in the past few years has increased efforts to expand Internet access in the developing world.

"We should be investing in privacy and security solutions for these people," wrote Facebook's Mr. Stamos, "not making it harder for them to use the Internet safely."