3 ms·
If SSL is broken, you are - as many people have noticed, screwed. JMAP itself is entirely encryption layer agnostic. It's transport layer agnostic. JMAP over
by brongondwana 12y ago
If SSL is broken, you are - as many people have noticed, screwed. JMAP itself is entirely encryption layer agnostic. It's transport layer agnostic. JMAP over HTTPS is definitely going to be the first layer, but we're looking at websockets with interest as well.
If you were insane, you could do JMAP over XMPP, or JMAP over email. That would be neatly recursive...
- mikhailt 12y agoExactly what I was trying to say but likely did it wrong. I rather have a secure modular system than a single protocol that does everything. We simply just can't leave it as JMAP+SSL because once SSL cannot be trusted, it should be easier to replace it with a better solution or an updated SSL protocol. I don't think it is reasonable to include this within JMAP and force all services to update jMAP overnight because the internal crypto library had a hole.
- uaygsfdbzf 12y agoIn case you hadn't noticed, the authenticity model of SSL was an afterthought and is completely broken. I recommend listening to Moxie's talk about this: https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...
- icebraining 12y agoI don't think that's very relevant for this use case, though - JMAP is clearly intended for use by custom clients, not browsers, and those can use SSL with a completely different model from the CA scheme, including bundling certs for the most popular providers (similar to HSTS preload lists).
- feld 12y agoEveryone has noticed. This cannot be solved overnight and rolled out to the entire planet. Stop beating this dead horse.