Anki-android: AnkiWeb will require TLS1.2 moving forward

[dae]

Hi all,

A heads up that TLS1.2 will be required to access AnkiWeb from Jan 1 2020:
https://anki.tenderapp.com/discussions/announcements/136-sunsetting-anki-20-support

From a brief Google, this looks like it may impact devices running early Android 4.x releases. If you want to retain compatibility, the following page may help: https://ankushg.com/posts/tls-1.2-on-android/

[mikehardy]

Thanks for the headsup! and Oh, how I have suffered with TLS1.2 support on Android 4.x. There are a few workarounds yeah

Likely related in this repo #3626

Possibly related but only if we clip Android API support up to Android 5 / API21. We still have thousands of users on API19 and I don't think we were contemplating moving up to API21 so likely won't be resolved #5223

I'm going to mark this is as high priority for us since the time is short

[mikehardy]

Relevant link to likely implementation we will need, from link above: https://gist.github.com/ankushg/8c0c3144318b1c17abb228d6211ba996

Note that as a test you need a server that already forces TLS1.2. There is likely a way to do this locally but I will submit that simply using a temporary file via direct download from dropbox works in my experience: https://github.com/mikehardy/react-native-update-apk#version-json-example

[timrae]

Sounds like a lot of fun 😬🤯

@mikehardy
I'm traveling the next two weeks then moving back to NZ for a new job, so please email me directly if there's some urgent action I need to take.

[mikehardy]

Will do - but should not be urgent action - safe travels @timrae

[dotancohen]

I should probably mention that I'm stuck on API 19 with my E-ink devices. Please don't bump to API 21. Please.

[dotancohen]

Googling around I see that there are in fact solutions to use TLS1.2 on Android 4.4 (API 19). For a working example of an app that supports TLS 1.2 on API 19, (Opera Mobile](https://ftp.opera.com/pub/opera/android/mobile/1210/). There are quite a few threads on the topic in developer forums as well.

[mikehardy]

No worries @dotancohen I was not seriously contemplating moving to API21. I've implemented several TLS hacks before for the old APIs and still have an old device I test with as well - it should be possible to support it :-)

[dotancohen]

@mikehardy Thank you! Your work - and Damien and Tim and everybody else - is very very much appreciated.

[mikehardy]

First step done, and publishing the WIP/Draft version just in case https://github.com/ankidroid/Anki-Android/pull/5658

The commit contains a link to the second phase of the transformation (switch to okhttp3 request/response style from OkApacheClient wrapper, enable TLS1.2 during client build), which will enable TLS1.2 for Android API<=21

[mikehardy]

@dotancohen please test, if possible: https://github.com/ankidroid/Anki-Android/pull/5658#issuecomment-565681882

[dotancohen]

@mikehardy Thank you, I will test.

[dotancohen]

I can confirm that AnkiDroid-2.10alpha17-TLS12.parallel.E.apk syncs fine in both directions on an Android 4.4 (API 19) Barnes & Noble Nook Glow3 E-ink device. Thank you!

[dae]

A heads up that the deadline on this was extended to Feb 1, so no need to rush out a release if it needs more testing.

[mikehardy]

Thanks @dae I think that will help as I won't be available for triage and any needed 2.10.1 until a few days after the new year. But we are close now at least and the deadline pressure was useful to get me moving at any rate. Cheers