On Fri, Aug 21, 2009 at 11:08:31AM -0700, Florin Andrei wrote:
> Victor Duchovni wrote:
>> It has been some time since I looked at this, hence the IIRC. Mulberry
>> made the setting explicit, and perhaps allowed one to choose the right
>> client cert. If I recall correctly, Thunderbird uses certificates
>> silently, without explicit configuration control... I any case, this
>> is not a very frequently used MUA feature.
>
> That's pretty disappointing. Sounds like man-in-the-middle attacks might
> actually be doable then.
If the client has robust server certificate verification, there is no
need for client certs to fend off MITM.
The Postfix SMTP client has robust server certificate verification. As
for various MUAs, they typically validate the server certificate even
when they don't support client certs.
Unlike the Postfix SMTP client, their verification code may be vulnerable
to the NULL byte issue disclosed by Dan Kaminsky and "Moxie Marlinspike"
at the most recent Black Hat conference, but bugs aside, the MUAs should
be able resist MITM without client certs.
> Would y'all be worried about the SASL authentication, given that the SSL
> layer has holes? I'm talking from a real-world perspective. Data - forget
> it, it's SMTP anyway. But the user/pass credentials - that's a different
> story.
Attacks on SSL would not be my primary concern, rather I'd be more
worried about phishing, malware, ... and other less sophisticated means
of compromising user credentials.
> Would you be comfortable sending authentication over this kind of SSL
> channel?
If you want to avoid password compromise, use CRAM-MD5 or GSSAPI, ...
> I'm trying pretty hard to avoid building a full-blown VPN just for the
> iPhone. I already use OpenVPN, but it doesn't work on the iPhone, so I
> would have to install / configure an IPSec thing from scratch if the iPhone
> doesn't play nice with SMTP / SSL / SASL. It's not rocket science but it's
> a lot of tedious work.
If you are using the Carrier networks, active attacks are not easy to
carry out. If you are using Wi-Fi, perhaps you need a client patched
against the NULL byte problem. Client certs are OK if the iPhone
mail client supports them, but it may not...
--
Viktor.
Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.
To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:[email protected]?body=unsubscribe%20postfix-users>
If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.
