3 ms·
Eugh, that might fly in some enterprise contexts but it violates a lot of principles what S/MIME is meant to be used for. Is there a draft for strict JMAP tran
by Avamander 3y ago
Eugh, that might fly in some enterprise contexts but it violates a lot of principles what S/MIME is meant to be used for.
Is there a draft for strict JMAP transport security?
- chrismorgan 3y agoJMAP is already TLS-only <https://datatracker.ietf.org/doc/html/rfc8620#section-8.1 https://datatracker.ietf.org/doc/html/rfc8620#section-8.1>: > To ensure the confidentiality and integrity of data sent and received via JMAP, all requests MUST use TLS 1.2 or later, following the recommendations in RFC 7525. Servers SHOULD support TLS 1.3 or later. > Clients MUST validate TLS certificate chains to protect against man-in-the-middle attacks.
- Avamander 3y agoThat's not "MUST prevent the end-user from trivially accepting the invalid chain" though, which is also an issue with current MUAs and IMAP/SMTP.