3 ms·
> a poorly-programmed client would fall back to using the protocol without TLS That was the whole point of STARTTLS - to allow a way to start a tunnel but be b
by hadoukenio 12y ago
> a poorly-programmed client would fall back to using the protocol without TLS
That was the whole point of STARTTLS - to allow a way to start a tunnel but be backwards compatible to older clients.
The real problem was that they didn't account for MITM attacks.
- gioele 12y agoMany applications that support STARTTLS can be configured to require a secure connection to be in place before sending any data.
- jgillich 12y agoNot just applications, servers as well. My Postfix/Dovecot setup does support unencrypted connections, but will refuse to do authentication if the channel is not encrypted.
- brongondwana 12y agoWhich is pointless when the plaintext password has already been sent across the wire.
- hobarrera 12y agoSince it's just for backwards compatibility, modern clients should never drop to unencrypted communication. It's the server that needs to support older clients, not the other way around.