* on the Fri, Apr 26, 2013 at 03:41:41PM +0200, Jan Kundr?t wrote: >> If enabling STARTTLS fixes this, it will only be because of a side >> affect that the LOGIN authentication method is advertised, only when >> the channel is encrypted. > > In IMAP, this is a very common configuration and it's made much more > obvious through the LOGINDISABLED capability. When Trojita sees that, > it will automatically activate STARTTLS even though the user has not > explicitly asked for encryption. > > I speculated that the SMTP protocol might work in a similar manner -- > the examples in RFC 4954 [2] show this behavior with the AUTH PLAIN > not being advertized until after STARTTLS.
Yes, this is perfectly acceptable behaviour for SMTP also. This bug concerns me: https://projects.flaska.net/issues/623 "The SMTP code does not invoke STARTTLS unless explicitly configured by the user. It would be great to do this when e.g. the server advertizes STARTTLS and does not offer a supported AUTH method." I don't think you should opportunistically use STARTTLS in this way. It is much better to fail hard, forcing the user to manually configure up encryption. If an authentication method is advertised over an encrypted channel, but not an unencrypted channel, you can be fairly certain that has been done on purpose because it is not safe to use it over an unencrypted channel. So... Imagine you visit an untrusted network after configuring up Trojita in this manner. A MITM could modify the contents of the servers EHLO response to remove "STARTTLS" from the list of supported extensions, and add unsafe authentication methods (PLAIN/LOGIN) into the response at the same time, which would cause Trojita to perform the authentication in an insecure manner rather than upgrading to an encrypted channel first. Just another related thought. It would be nice if Trojita "noticed" that STARTTLS was available, and warned the user that they're not taking advantage of it (if they aren't). This could be a one off warning, and wouldn't necessarily happen at initial configuration time. Imagine for example, your mail provider decides to start offering SSL six months after you configure up Trojita to use them. It would be nice if the next time you connected it popped up a message: "Encryption is now available for this connection, but I am not currently configured to use it. Would you like me to use encryption from now on?" -- Mike Cardwell https://grepular.com/ http://cardwellit.com/ OpenPGP Key 35BC AF1D 3AA2 1F84 3DC3 B0CF 70A5 F512 0018 461F XMPP OTR Key 8924 B06A 7917 AAF3 DBB1 BF1B 295C 3C78 3EF1 46B4
signature.asc
Description: Digital signature
