TLS at the protocol level

In October 2014 three Google researchers, Bodo Möller, Thai Duong and Krzysztof Kotowicz, published an attack they called POODLE. A network attacker could make a browser fall back to SSL 3.0, then exploit the way that version checked CBC padding to decrypt a session cookie, roughly one byte per 256 requests.

The IETF prohibited SSL 3.0 in RFC 7568 in June 2015, and in March 2021 RFC 8996 formally deprecated TLS 1.0 and 1.1 as well. TLS 1.3, published in August 2018 as RFC 8446, had already removed what made those attacks possible: CBC modes, RSA key transport, compression, renegotiation and dozens of legacy options.