Google sets deadline for next month on June 16, 2016

May 17, 2016 21:35 GMT  ·  By

Google announced on Monday it was dropping official support for SSLv3 and the RC4 cipher after June 16, 2016. This announcement affects Google’s SMTP servers and Gmail’s web servers.

Users that utilize these services, like webmasters running apps on the Apps platform and those interacting with Gmail, are asked to adjust any side-services in order to avoid technical problems and downtime.

Additionally, users using older email clients and Web services sending messages via SSLv3 and RC4 will no longer be able to exchange any emails messages with Google's infrastructure.

"SSLv3 has been obsolete for over 16 years and is so full of known problems that the Internet Engineering Task Force (IETF) has decided that it must no longer be used," the Google engineers explained. "RC4 is a 28-year-old cipher that has done remarkably well, but is now the subject of multiple attacks at security conferences. The IETF has decided that RC4 also warrants a statement that it too must no longer be used."

While everyone knew by now that RC4 is a weak cipher, SSLv3 was still considered acceptable until 2014, when the POODLE attack hurried up the migration to the newer TLS. Some TLS implementations are also vulnerable.

Google initially announced it was giving up on SSLv3 and RC4 last fall but never mentioned a deadline. In the meantime, the company says the vast majority of its clients have migrated to newer technologies, so it felt comfortable officially removing support for both specs.