Hacker Newsnew | past | comments | ask | show | jobs | submit | soetis1's commentslogin

Since proper email transport encryption is finally getting some momentum with DANE and MTA-STS, I'm surprised that STARTTLS Everywhere doesn't mention them.

DANE is being recommended (mandated?) by the European Union, and is on the rise. MTA-STS is backed by Gmail, Microsoft and many others, which is likely to give it traction.


We do mention both: see https://www.eff.org/deeplinks/2018/06/technical-deep-dive-st...

To sum up from that post, we think STARTTLS Everywhere is a stop-gap measure until DNSSEC is fully deployed, and STARTTLS Everywhere can act as a preload list for MTA-STS (to prevent DNS downgrade attacks).



The draft is very clear about DANE being preferred from both a security and deployment perspective (does't need to get certificates for all hosted domains).

Sure, if DNSSEC fail, then SMTP-STS is better than nothing.

I'm pretty sure that the big providers could have had deployed DNSSEC relatively easily, if they just wanted to.

I think other DNS-based email security features such as DKIM and DMARC motivates DNSSEC as well.


You obviously didn't read the link you posted. Email servers cannot do name verification with CAs, because there's no mapping to the domain/MX http://www.postfix.org/TLS_README.html#client_tls_verify


can confirm; wifi configured with static ip, l2tp doesn't work.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: