News for hackers. Stuff that matters.
Re:RFC 8314: Use of Transport Layer Security for Email Submi... by khm on Wednesday January 31, 2018 @09:11PM (#16279241)
MTA-STS is pretty ill-conceived. In essence it mandates that compliant MTAs also run a concurrent web service. The authors do not explain why this is useful instead of the simpler approach -- enhance SMTP to reject mail on port 25 with a NEEDS-TLS error, then fall back to implicit TLS (what port 465 was originally for).
Re:RFC 8314: Use of Transport Layer Security for Email Submi... by noblethrasher on Thursday February 01, 2018 @01:53AM (#16280062)
The system needs to be able to authenticate a DNS-resolved endpoint. HTTPS provides this.

Of course, they could have gone with DNSSEC, but HTTPS has the virtue of solving the same problem (modulo proper configuration), while also being more widely deployed and better understood.

Re:RFC 8314: Use of Transport Layer Security for Email Submi... by khm on Thursday February 01, 2018 @02:41AM (#16280224)
HTTPS does not provide authentication sufficiently well to put every egg in its basket.

As for "better understood," the authors of this standard work for Google, Verizon, Microsoft, and Comcast. Combined they probably serve most of the email in the western hemisphere.

There is no excuse for overcomplicating a proposed standard -- and "we have this stuff lying around" is no exception. This plan has the effect of causing a networking protocol to depend on an entire series of unrelated networking protocols.

It does not bode well for the future of independent email operators and it provides no path forward for integrating existing devices. It pushes many, many extra steps onto client devices, necessitating entire additional libraries of software to deal with them. That's not a problem for companies with tens of thousands of developers at their beck and call -- but it is only going to raise the barrier-to-entry of operating an independent service.

Re:RFC 8314: Use of Transport Layer Security for Email Submi... by korethr on Thursday February 01, 2018 @01:50PM (#16284537)
Those sound like reasonable objections. Are you posting them to the discussions involved in shaping and ratifying the proposed standard?
Re:RFC 8314: Use of Transport Layer Security for Email Submi... by e12e on Thursday February 01, 2018 @08:38AM (#16281727)
What does https do that's different from verifying the cert chain and matching the cn to the hostname? Is this about the ill-conceived cert-pinning that pretends distributing keys for every domain is a scalable alternative to certificate authorities and on-line revocation lists?
Re:RFC 8314: Use of Transport Layer Security for Email Submi... by noblethrasher on Thursday February 01, 2018 @11:16AM (#16282985)
An MTA-STS web server is also used for policy discovery, and the HTTPS requirement ensures that the policy is authentic.