Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4677

Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

Show all headers | View raw

On Sun, Apr 10, 2016 at 9:22 AM, Elmar Stellnberger <estellnb@gmail.com> wrote:
>   Is anyone here who can explain the insecurity of SSL/TLS in its current
> state?

TLS properly implemented is secure. The insecure VPN (as you so
describe it) may have been stripping out the offer of STARTTLS by the
IMAP server. This is pretty trivial to do when you control all of the
data flowing through the VPN [1]. This has actually been done by some
ISPs in the past [2].

Although the RFC for STARTTLS indicates that clients should fallback
if TLS is not available [3], last time I checked if you have STARTTLS
specified in the server settings in Thunderbird, it should not be
establishing a connection if it is unable to do so over TLS.

What are the server settings you are using for IMAP?
Was it a successful login or an attempted login?
Did you accept any certificate warnings?

[1] https://github.com/tintinweb/striptls
[2] https://www.eff.org/deeplinks/2014/11/starttls-downgrade-attacks
[3] https://tools.ietf.org/html/rfc2595

Brandon Vincent

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-10 18:30 +0200
  Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-11 00:10 +0200
    Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 08:30 +0200
  Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Evgeny Kapun <abacabadabacaba@gmail.com> - 2016-04-11 09:00 +0200
    Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 10:20 +0200
      Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-04-11 11:30 +0200
        Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 19:30 +0200
          Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Vaughn Graham <vaughng@dmsllconline.net> - 2016-04-11 21:00 +0200
            Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 21:20 +0200
            Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-12 05:20 +0200
      Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-11 15:00 +0200
        Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 21:50 +0200
          Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 22:50 +0200

csiph-web