From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/67414 Path: news.gmane.org!not-for-mail From: arno@natisbad.org (Arnaud Ebalard) Newsgroups: gmane.emacs.gnus.general Subject: Re: Bug#499774: starttls is a joke Date: Mon, 22 Sep 2008 19:48:45 +0200 Message-ID: <87wsh4gjgi.fsf@natisbad.org> References: <871vzca7gp.fsf@natisbad.org> <87y71kpmq7.fsf@bubble.risko.hu> <87od2g31hf.fsf@natisbad.org> <87tzc8upgf.fsf@marauder.physik.uni-ulm.de> <87fxnsjfu3.fsf@mocca.josefsson.org> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1222105920 24354 80.91.229.12 (22 Sep 2008 17:52:00 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 22 Sep 2008 17:52:00 +0000 (UTC) Cc: Daiki Ueno , 499774@bugs.debian.org, RISKO Gergely , ding@gnus.org To: Simon Josefsson Original-X-From: ding-owner+M15865@lists.math.uh.edu Mon Sep 22 19:52:57 2008 Return-path: Envelope-to: ding-account@gmane.org Original-Received: from util0.math.uh.edu ([129.7.128.18]) by lo.gmane.org with esmtp (Exim 4.50) id 1Khpad-0001GX-BI for ding-account@gmane.org; Mon, 22 Sep 2008 19:52:51 +0200 Original-Received: from localhost ([127.0.0.1] helo=lists.math.uh.edu) by util0.math.uh.edu with smtp (Exim 4.63) (envelope-from ) id 1KhpYz-0004IJ-Uy; Mon, 22 Sep 2008 12:51:10 -0500 Original-Received: from mx1.math.uh.edu ([129.7.128.32]) by util0.math.uh.edu with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1KhpYx-0004Hv-SH for ding@lists.math.uh.edu; Mon, 22 Sep 2008 12:51:07 -0500 Original-Received: from quimby.gnus.org ([80.91.231.51]) by mx1.math.uh.edu with esmtp (Exim 4.69) (envelope-from ) id 1KhpYu-0007mx-Pq for ding@lists.math.uh.edu; Mon, 22 Sep 2008 12:51:07 -0500 Original-Received: from moog.chdir.org ([88.191.42.160]) by quimby.gnus.org with esmtp (Exim 3.36 #1 (Debian)) id 1KhpYy-0005ZO-00 for ; Mon, 22 Sep 2008 19:51:09 +0200 Original-Received: from [2001:7a8:78df:2:20d:93ff:fe55:8f78] (helo=localhost.localdomain) by moog.chdir.org with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1KhpYM-0000ej-3d; Mon, 22 Sep 2008 19:50:30 +0200 X-PGP-Key-URL: http://natisbad.org/arno@natisbad.org.asc X-Fingerprint: 47EB 85FE B99A AB85 FD09 46F3 0255 957C 047A 5026 X-Hashcash: 1:20:080922:ueno@unixuser.org::fB1Bl5QkpUpr+/d4:0000000000000000000000000000000000000000000011zG X-Hashcash: 1:20:080922:ding@gnus.org::ck7B+F447esa/+4q:00002oZd X-Hashcash: 1:20:080922:499774@bugs.debian.org::ZMDyvUeyLdNKsXX0:0000000000000000000000000000000000000002snc X-Hashcash: 1:20:080922:risko@debian.org::gRu35UyVEWgQlkP4:0Bzdf X-Hashcash: 1:20:080922:simon@josefsson.org::eNscNIkXc4pzrq0M:000000000000000000000000000000000000000000CUs8 In-Reply-To: <87fxnsjfu3.fsf@mocca.josefsson.org> (Simon Josefsson's message of "Mon, 22 Sep 2008 18:38:44 +0200") User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.2 (gnu/linux) X-Spam-Score: -2.6 (--) List-ID: Precedence: bulk Xref: news.gmane.org gmane.emacs.gnus.general:67414 Archived-At: Hi, Simon Josefsson writes: > Reiner Steib writes: > >> Would it make sense to prefer gnutls-cli and warn when using starttls >> (if gnutls-cli is not installed)? > > Possibly, yes. I use stunnel w/ Gnus. Some friends of mine use socat. > Note that emacs22 (the version in debian testing) supports both starttls > and gnutls-cli, so the comment made earlier that removing the starttls > package will break imaps/pop3s connections from emacs based muas is > false. +1 >>> "This software does not have any authentication capabilities: it does >>> not allow you to authenticate your peer, which is a basic requirement >>> for TLS/SSL to be used securely. You should only use it for testing >>> purposes and not relaying important information. Be aware that you are >>> vulnerable to MITM when using it" > > That seems correct to me. > > Note that even if you use gnutls-cli, you need to configure it to use > appropriate trust anchors to get full security. ^^^^^^^^^^^^^ I hope you mean "a working setup". If you do not provide it any (set of) trust anchor, it should not be able to verify server's certificate and should fail, shouldn't it? > If you don't, I believe gnutls-cli is still superior to starttls > though, since gnutls-cli verify that the server hostname match the > hostname in the certificate. IMHO, this is not superior. It is just as broken. Cheers, a+