ZDNet reports the Internet Engineering Task Force (IETF) has finally approved version 1.3 of Transport Layer Security (TLS), the key protocol that enables HTTPS on the web:
TLS is the successor to SSL and version 1.3 was designed to prevent attacks that undermined client and server communications secured with TLS 1.2 and earlier versions.
The main benefit of TLS 1.3 is that it supports stronger encryption and drops a host of legacy encryption algorithms.
It also introduces 0-RTT or zero round trip time resumption, which is designed to speed up connections on sites that users frequently visit and is expected to deliver lower latency on mobile networks.
Major internet players have been gradually upgrading to TLS 1.3 over the past few years, though there have been hiccups and obstacles to its deployment.
While Chrome, Firefox and Opera and Edge already support TLS 1.3, they don’t by default. A study by Cloudflare, which enabled TLS 1.3 by default on the server side last year, found that in December that just 0.6 percent of traffic was secured with TLS 1.3. The cause was in part due to how network appliance vendors had implemented TLS 1.2.
Best I can tell is TLS 1.3 does not change SSL decryption when security devices sit inline and essentially act as a man-in-the-middle attack. If your employer is, say, using an intrusion prevent system or web gateway to inspect traffic on the network, and is performing SSL decryption on HTTPS connections, TLS 1.3 does not offer any privacy increase since the decryption capability is still completely possible.