3 ms·
STARTTLS is vulnerable to active MITM downgrade attack. Are there any equivalent techniques to HTTP Strict Transport Security ("Remember me and don't talk to me
by nly 12y ago
STARTTLS is vulnerable to active MITM downgrade attack. Are there any equivalent techniques to HTTP Strict Transport Security ("Remember me and don't talk to me over an insecure protocols again") for SMTP?
- bitJericho 12y agoI think DKIM/SPF resolves that. The recipient (spf) or the sender (DKIM) of the email decides what servers are allowed to send out mail for a domain.
- capnrefsmmat 12y agoThat doesn't stop a MITM impersonating the recipient of the message; it just stops someone impersonating the sender.
- nly 12y agoIt doesn't even stop that, since we're talking about a MITM between a legitimate sender and receiver.
- bitJericho 12y agoWell I guess you'd know about the MITM after the attack, since the email could get rejected if it comes from a bad IP. But yes you guys are absolutely right. PGP ftw?
- agwa 12y agoThere's no solution exactly like HSTS, though DANE+DNSSEC provides a solution to the downgrade (and cert validation) problem. Postfix has an implementation. Unfortunately it requires DNSSEC, which has issues. Also, EFF is working on a project like HTTPS Everywhere but for SMTP encryption: https://github.com/EFForg/starttls-everywhere https://github.com/EFForg/starttls-everywhere
- andrewaylett 12y agoDANE should solve this eventually; in the meantime I have a hardcoded smtp_tls_policy_maps which I've populated with domains that I frequently email and which the logs show support TLS.