"Useless" and "Clueless" is rather harsh Viktor, and you most certainly don't us what we're trying to accomplish.
Fact is we've achieved quite a lot by launching this service, several ISPs have implemented STARTTLS, same goes for large companies and government organisations after launch and media coverage of them not having STARTTLS at all. Several others have added certs from CA's, renewed expired certs, renewed certs because of Heartbleed (...) and more. While I cannot prove they did these things because of this useless and clueless service, sometimes I like to believe for myself that it just might made a positive difference to some. It will continue to operate, and I hope we'll be able to expand it to do additional checks of configurations such as those proposed by you. Best regards, Per Thorsheim Den 20.05.2014 15:56, skrev Viktor Dukhovni: > On Tue, May 20, 2014 at 02:35:04PM +0100, Colin Fowler wrote: > >> BTW, this whole thing came about from me testing using >> https://starttls.info/ which scored what I thought was a well secured server >> quite badly. I see now that the testing site is itself the problem, not my >> original config. > Yep, the site is clueless. My DNSSEC + DANE validated domain scores a "D": > > mx1.dukhovni.org: Grade: D (43.5%) > > Certificate: > > * The certificate is not valid for the server's hostname. > * There is a self-signed certificate in the trust chain. It may be a > configuration problem. > * There are one or more fatal problems which causes the > certificate not to be trusted. > > There are validity issues for the certificate. Certificates > are seldom verified for SMTP servers, so this doesn't mean that > STARTTLS won't be used. > > [ Actually, I have one of the few SMTP domains whose certificate can be > used for MiTM-resistant authentication. ] > > Generally speaking it's a bad practice not to have a valid > certificate, and an even worse practice not to verify them. > Any attempted encrypted communication is left all but wide open > to Man-in-the-Middle attacks. > > [ Except that not authenticating certificates is exactly what one > needs to do with SMTP. ] > > Protocol: > > * Supports SSLV3. > * Supports TLSV1. > * Supports TLSV1.1. > > Key exchange: > > * Anonymous Diffie-Hellman is accepted. This is suspectible to > Man-in-the-Middle attacks. > > [ But DANE clients won't offer this. And server support of aNULL ciphers > is always harmless, and makes it easier to determine which clients are > not authenticating the server. Pretending client offers of aNULL ciphers > did not happen does not improve security. ] > > > * Key size is 1024 bits; that's somewhat insecure. > > [ Fine, will be changed when the server is upgraded... ] > > Cipher: > > * Weakest accepted cipher: 0. > * Strongest accepted cipher: 256. > > [ Scoring aNULL as "0" is simply wrong. ] > > > This site is useless. >
