Re: [Imap-protocol] STARTTLS after PREAUTH

>>>>> "BG" == Bron Gondwana <[email protected]> writes:

BG> Your hypothetical MITM just strips the "LOGINDISABLED" capability
BG> response, and anything saying that the server supports TLS, and the
BG> client goes ahead and sends the credentials in cleartext.

The ietf consensus was that having every protocol which wants to use tls
require a second port number was impractical; that some mechanism was
required to support unencrypted and encrypted connections on a single port.

Clients can have OOB knowledge that tls must be used; many UIs have a
checkbox, config-file setting or the like to specify whether tls is
desired or required for a given server.  Clients configured to expect
starttls will abort if it does not work.

Servers also can require tls, even when using startls to initiate it,
for access to some or all resources.  TLS-level client authentication
probably is required to prevent a MITM unless the clients are all
configured to demand tls for said server.

Some servers (ipp servers are known to do this) also support recognizing
tls vs plaintext at the start of a session and doing the right thing.

In the specific case of imap, I'd prefer to configure servers to demand
starttls before permitting any authentication, and to inform the users
to configure their clients always to demand startls.

Perhaps with rfc 5054 support, where possible.

-JimC
--
James Cloos <[email protected]>         OpenPGP: 1024D/ED7DAEA6
_______________________________________________
Imap-protocol mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-protocol