News for hackers. Stuff that matters.
Re:Internet Draft: SMTP Strict Transport Security by jcrites on Saturday March 19, 2016 @09:39PM (#11321379)
At least in email's case, the most common pattern is for SMTP connections to begin in plaintext and then be upgraded to TLS. This involves the client sending a command to the server inquiring about the server's protocol extensions. The server advertises STARTTLS [1], and then the client invokes the command to upgrade to it. These interactions are all SMTP-specific, and so the SMTP client and server both need to be aware of it. (The client should presumably keep trying to upgrade to TLS, and not send the message plaintext; and a server one day might reject connections that haven't been upgraded.)

For protocols where the common pattern is to establish a connection using TLS from the beginning, it would be easier to do something like what you're describing.

[1] https://tools.ietf.org/html/rfc3207

There are no comments on this comment yet.