2 ms·
This bug could have an equivalent in imaps if the client decided to send plaintext data under some conditions.
by jojobas 6y ago
This bug could have an equivalent in imaps if the client decided to send plaintext data under some conditions.
- corty 6y agoYes, but TLS downgrade bugs that revert to plaintext are getting rarer due to better TLS libraries preventing the use of NULL ciphers and the like. I would say it is possible but far less likely than a starttls downgrade, where the plaintext stuff is an integral part of every connection, and the dangerous codepath is right next to the encrypted happy path with frequent crossings...