Re: Bug#499774: starttls is a joke

[Simon Josefsson <simon@josefsson.org>]

Matthias Andree <matthias.andree@gmx.de> writes:

> [Stripping Debian BTS bug from Cc: list]
>
> Simon Josefsson <simon@josefsson.org> writes:
>
>> arno@natisbad.org (Arnaud Ebalard) writes:
>>
>>>>>> "This software does not have any authentication capabilities: it does
>>>>>> not allow you to authenticate your peer, which is a basic requirement
>>>>>> for TLS/SSL to be used securely. You should only use it for testing
>>>>>> purposes and not relaying important information. Be aware that you are
>>>>>> vulnerable to MITM when using it"
>>>>
>>>> That seems correct to me.
>>>>
>>>> Note that even if you use gnutls-cli, you need to configure it to use
>>>> appropriate trust anchors to get full security.
>>>                                    ^^^^^^^^^^^^^
>>>
>>> I hope you mean "a working setup". If you do not provide it any (set of)
>>> trust anchor, it should not be able to verify server's certificate and
>>> should fail, shouldn't it?
>>
>> Right, and that's what I meant with "you need to configure it to use
>> appropriate trust anchors".  If you do that, you should get full
>> security (whatever that means).
>
> Please change that for gnutls-cli 2.8.0 - preferably, the tool should
> get a new name then to make the change of paradigm obvious to consumers
> such as Gnus.

You've lost me, exactly what change are you talking about?  And what is
wrong today?

/Simon