5 ms·
Lavabit Security Misconfiguration
- MichaelGG 9y agoShouldn't it be using IMAPS instead of STARTTLS anyways?
- Bino 9y agoI always favor STARTTLS in favor of implicit. I say so since implicit TLS on SMTP (465) is deprecated.
- MichaelGG 9y agoWhy? What benefit is there in starting plaintext, and as the post shows, allowing clients to transmit credentials? And is IMAPS deprecated? Not that it matters -- the IETF or IANA deprecating something or unassigning a port is not really much of a justification.
- Bino 9y agoIt was unnecessary to split the protocol into two ports when STARTTLS came along shortly after. As for myself, I also thinks it's nice that you can partly identify the usage of a port by connecting to it. https://en.wikipedia.org/wiki/SMTPS https://en.wikipedia.org/wiki/SMTPS
- MichaelGG 9y agoStill doesn't address sending credentials plaintext or what benefit this has, at all. Adds another roundtrip for no benefit. Using TLS doesn't change the identification, just requires a few packets to be exchanged; not a huge deal. So again, how did Lavabit help its customers by not forcing TLS for IMAP?
- floatingatoll 9y agoI'd love to know more about why this was considered insufficient to qualify for industry-common disclosure practices while simultaneously described as a 'Security' misconfig. If it's a security issue, then responsible disclosure. If it's not a security issue, then it's not 'Security'. Right?
- floatingatoll 9y agoFOLLOWUP: Thanks to all who replied. Disclosure is far more complex than the article hinted at, and the discussion here provides the context around 'Should I disclose?' that was absent from the original article.
- floatingatoll 9y ago"I reported this issue only a few hours ago, but I don’t consider this category of problem to require a delayed disclosure."
- mynewtb 9y agoIt is not an issue that anyone but a highly capable adversary could exploit. As the post says, you have to assume that all internet traffic is being collected. Thus disclosure does not harm anyone and instead allows users to protect themselves.
- mike-cardwell 9y agoThere is a risk of leakage of credentials and private data. Delaying disclosure does not reduce that risk in this situation; if anything it increases the risk. People delay disclosure when disclosing early would increase risk. That is not the case here. > If it's a security issue, then responsible disclosure. No. Immediate disclosure when it is the right thing to do. Delayed disclosure when it is the right thing to do. > If it's not a security issue, then it's not 'Security'. Right? Yes. If an issue is not a security issue, then it is not a security issue.
- CiPHPerCoder 9y ago> If it's a security issue, then responsible disclosure. See: https://adamcaudill.com/2015/11/19/responsible-disclosure-is-wrong/ https://adamcaudill.com/2015/11/19/responsible-disclosure-is...