On 03/06/15 01:35, Daniel Kahn Gillmor wrote:
This sounds like a feature, not a bug, because it means that users are
now aware that their "secure" imap connections are probably not what
they expect.
Agreed, but the consequences for Debian end-users are that they may be
forced to stop using a not-as-strong-as-it-could-be 768 bit DH key
(*not* as weak as a 512 bit break-with-$75-ofAmazon-EC2 DH key). Instead
Debian end-users have to switch to unencrypted IMAP. How does this
improve security and protect users? In my view, a warning would be more
appropriate, at least as a transitional measure. Most users would have
no idea why their IMAP suddenly stopped working. At the least there
should have been a warning issued when the Debian library was upgraded.
Even better, icedove should detect the condition, offer a dire warning,
and allow the user to give their informed consent to the situation, as
is done for broken certs. In my view, the actions of the Mozilla NSS
team were high-handed and inappropriate for a patch version release.
Are these IMAP servers in the wild? Could you point me to them?
Sure, buried in the original bug report:
$ openssl s_client -connect ub007lcs04.cbr.the-server.net.au:993
I have notified the responsible hosting provider that they should
upgrade their Courier IMAP DH key to 2048 bits. Given the state of their
certificate chain (even their self-signed certificates are expired) I am
not optimistic.
Kind regards,
--
Ben Caradoc-Davies <b...@transient.nz>
Director
Transient Software Limited <http://transient.nz/>
New Zealand
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
