Re: Re: Python standard library defaults to insecure TLS for mail protocols

[Hanno Böck <hanno () hboeck de>]

On Thu, 1 Feb 2024 09:45:36 -0800
nightmare.yeah27 () aceecat org wrote:

> Relaying *MTAs* do not usually verify the certificate of the server
> they connect to.

Even that isn't true any more in 2024. The largest mail providers (and
plenty of small ones) all support MTA-STS. So in most cases,
certificate validity and hostnames are checked.

> When they do, it creates problems because MTA
> certificates are very often self-signed. IIRC Yahoo relays in
> particular used to have this problem (or still do?)

Doubtful:
host -t txt _mta-sts.yahoo.com
_mta-sts.yahoo.com descriptive text "v=STSv1; id=20161109010200Z;"

If they had invalid certs, they wouldn't receive any mails from MTA-STS
supporting senders. I think someone would've noticed.

> It is true that MTAs are not usually written in Python :-) So maybe
> the proposal is OK. But there's a general point to note here, namely
> not all protocols are the same wrt TLS.

Some are slower, others are faster, but all of them should strive for
deprecation of man-in-the-middle-vulnerabilities by default.


-- 
Hanno Böck
https://hboeck.de/