On 8/3/22 12:11 PM, Andrew C Aitchison via mailop wrote:
What you mean by "actual security differences" may be significant.
I figured that there were things that I wasn't aware of. Hence playing the part of the fool to learn.
IIUC the "No STARTTLS" people have found that, when connecting a TLS library to application code, allowing connections to be upgraded from clear to encrypted produces many more bugs than just requiring the connection to be secure from the start.
Interesting. I see this as potentially untested / less well tested code paths which are in and of themselves additional attack surface that doesn't exist when implicit TLS is used.
There is also the elephant in the room that servers must properly be configured to require explicit TLS. Something that may be overlooked.
-- Grant. . . . unix || die
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
