Unfortunately STARTTLS is broken beyond repair.
Unfortunately STARTTLS is broken beyond repair. STARTTLS is sent via the unprotected SMTP channel. The biggest problem with this isn't the lack of encryption, but more the lack of MitM protections. Imagine if when you wanted to connect to your bank over HTTPS you first had to send a HTTP request which asks permission to "upgrade" to HTTPS. Obviously any bad guy worth their salt is going to intercept that unprotected HTTP traffic, strip out the STARTTLS, and then leave you using the HTTP channel they can monitor or alter. So while, yes, in this case ISPs are likely "MitM"-ing their own traffic (which by definition isn't a MitM), it still leaves you open to bad guys on your side of the connection (e.g. the insecure WiFi problem). But even if ISPs weren't someone else could be.
Posted by Someone1234 on Nov 11, 2014, 11:08 PM
Tags
Related issues
- I know that Apple MFI certified Lightning cables work well with iDevices, but I found that third-party non-MFI-certified Lightning cables...
- Apple are similarly bad with iCloud nagging on iPhone: Microsoft and Apple want recurring monthly income and are willing to use dark patt...
- RFC: PDF Form Elements
- I don't believe this claim from their web site: "you can still run your favourite apps…, conveniently access your bank accounts".
- By art you mean inside information, or who has the money--connections to get light sentences when caught--unless the government wants to ...
- Here's my solution: 1.
Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments
reliability (FinTech)
I know that Apple MFI certified Lightning cables work well with iDevices, but I found that third-party non-MFI-certified Lightning cables...
Apple are similarly bad with iCloud nagging on iPhone: Microsoft and Apple want recurring monthly income and are willing to use dark patt...
RFC: PDF Form Elements
I don't believe this claim from their web site: "you can still run your favourite apps…, conveniently access your bank accounts".
By art you mean inside information, or who has the money--connections to get light sentences when caught--unless the government wants to ...
Here's my solution: 1.
I agree wholeheartedly with all of the points you're trying to make but the spoken word / snailmail comparison is broken and detract...
Wow.
Unfortunately STARTTLS is broken beyond repair.
Unfortunately STARTTLS is broken beyond repair. STARTTLS is sent via the unprotected SMTP channel. The biggest problem with this isn't the lack of encryption, but more the lack of MitM protections. Imagine if when you wanted to connect to your bank over HTTPS you first had to send a HTTP request which asks permission to "upgrade" to HTTPS. Obviously any bad guy worth their salt is going to intercept that unprotected HTTP traffic, strip out the STARTTLS, and then leave you using the HTTP channel they can monitor or alter. So while, yes, in this case ISPs are likely "MitM"-ing their own traffic (which by definition isn't a MitM), it still leaves you open to bad guys on your side of the connection (e.g. the insecure WiFi problem). But even if ISPs weren't someone else could be.
Comments (0)
No comments yet. Start the discussion.