Skip to content

Comment on STARTTLS Considered Harmfulparent

Comments

Yes, the point about downgrades is moot when it comes to server-to-server SMTP, since downgrades have to be allowed to be interoperable.

The downgrade problem isn't moot with other protocols (like IMAP or client-to-server SMTP) which are virtually always expected to be secure. And the other points, about how STARTTLS adds complexity and prevents protocol-agnostic termination, still apply.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.