[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <h6fanw237osiahbsep54i434unwngcsp4yd3kfapm2oyirwc5h@gs3lsdmtnonm>
Date: Fri, 2 Feb 2024 12:30:22 -0800
From: nightmare.yeah27@...ecat.org
To: oss-security@...ts.openwall.com
Subject: Re: Python standard library defaults to insecure TLS for mail
protocols
On Thu, Feb 01, 2024 at 09:27:15PM +0100, Hanno Böck wrote:
> > Relaying *MTAs* do not usually verify the certificate of the
> > server they connect to.
> Even that isn't true any more in 2024. The largest mail providers
> (and plenty of small ones) all support MTA-STS. So in most cases,
> certificate validity and hostnames are checked.
> > When they do, it creates problems because MTA certificates are
> > very often self-signed. IIRC Yahoo relays in particular used to
> > have this problem (or still do?)
> Doubtful:
> host -t txt _mta-sts.yahoo.com
> _mta-sts.yahoo.com descriptive text "v=STSv1; id=20161109010200Z;"
> If they had invalid certs, they wouldn't receive any mails from
> MTA-STS supporting senders. I think someone would've noticed.
I see little point in re-litigating the rest of the argument, but I
should note that I meant this the other way. Yahoo used to be the one
major *sender* provider that checked the recipient certs, and when it
failed it fell back to plaintext.
--
Ian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
