On 23/10/09 18:12 +0200, Hartmut Goebel wrote: > Cédric Krier schrieb: > > > I don't agree with: > > > > - The Tryton client must not fall back to non-SSL communication, but > > deny connection. - The user must be able to request SSL when setting > > up a connection to the server. > > > > SSL is only a configuration on the server side. > > No! If the client can not be forced to use SSL (but fall back to > non-SSL), an intruder may easily intercept the connection. And the > client has no chance to see, there is something going wrong. > > SSL is not only for encryption but even more important for > authenticating the server to the client. (I should have stated this in > the wiki, will add it just after this mail.)
It is only a matter of certification validation/acceptance. And it can have an option to popup if it is not a SSL connection like browser do. > > > - The administrator should be able to configure the client in a way > > hat only SSL connections are allowed and the user is not allowed to > > change this option. > > > > I don't understand. Who is administrator? > > The one who is installing the client. Remember: we are talking about an > enterprise environment here. Installation packages are provides by the > admin. It is not possible except if you create a specific exe and even with that you can still download the official client and run it without installation. Security is also about teaching users. > > > - Minimum SSL version to be used: SSLv3 > > > > Why? It can be just an option on the server side. > > No! SSLv2 is insecure and must no longer be used. > Why forced people. An option is enough with default value to SSLv3 for now it is SSLv23. But we must check the compatibility with all environments. -- Cédric Krier B2CK SPRL Rue de Rotterdam, 4 4000 Liège Belgium Tel: +32 472 54 46 59 Email: [email protected] Jabber: [email protected] Website: http://www.b2ck.com/
pgpkQLs8jepxf.pgp
Description: PGP signature
