On Sat, Oct 31, 2015 at 07:15:51AM -0400, Watson Ladd wrote:
> > STARTTLS is designed to thwart exactly one attack: *passive* wiretap.
> > It works as designed for just that attack. It is not surprising
> > that active attacks can and do defeat STARTTLS,
>
> Before STARTTLS adoption the Tunisian secret police read all your
> emails. Afterwards they still do. What was gained? Let's try solving
> that problem.
Funny you should say that, that's a good part of what I've been
doing for the past 2.5 years. However, simply having more SMTP
servers feeling good about useless WebPKI certs is not the answer.
Additional, downgrade-resistant out-of-band signalling is required
as explained in RFC7435 and RFC7672. I've been working on one such
signalling model that is gaining some initial traction.
--
Viktor.
_______________________________________________
Uta mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/uta
