Re: More haste, less speed.

Viktor Dukhovni <ietf-dane@dukhovni.org> Mon, 06 March 2017 22:01 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47D3B1294CF for <ietf@ietfa.amsl.com>; Mon, 6 Mar 2017 14:01:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x-Iym8lq10rF for <ietf@ietfa.amsl.com>; Mon, 6 Mar 2017 14:01:13 -0800 (PST)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C09A812949B for <ietf@ietf.org>; Mon, 6 Mar 2017 14:01:13 -0800 (PST)
Received: from [172.31.30.83] (gzac12-mdf2-1.aoa.twosigma.com [208.77.215.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id A1E337A32D8 for <ietf@ietf.org>; Mon, 6 Mar 2017 22:01:12 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Subject: Re: More haste, less speed.
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <20170306134017.29d2290c@spidey.rellim.com>
Date: Mon, 06 Mar 2017 17:01:11 -0500
Content-Transfer-Encoding: 7bit
Message-Id: <207B0EDA-4CF8-4665-974F-4CD159BCF89A@dukhovni.org>
References: <CAMm+Lwg1dvzMSKbWwoF0V6ZM5Q5_WVYxvpV=4_u=T0OTjCPxPQ@mail.gmail.com> <DF91F5B4-D8A0-4569-9011-3C3E38C71F07@dukhovni.org> <CAMm+LwjWqXg_EA7_0aT5DagZv4YirreUv1wKGAtBir01WwMT5Q@mail.gmail.com> <205292A2-2134-4DAA-BE0E-E76487A615E4@dukhovni.org> <20170306134017.29d2290c@spidey.rellim.com>
To: IETF general list <ietf@ietf.org>
X-Mailer: Apple Mail (2.3259)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ietf/fk4_wN6TMjZffRjRUtL0AfYMyRc>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
Reply-To: IETF general list <ietf@ietf.org>
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Mar 2017 22:01:15 -0000

> On Mar 6, 2017, at 4:40 PM, Gary E. Miller <gem@rellim.com> wrote:
> 
>> This is not true for SMTP, which is vulnerable to downgrade attacks
>> if the security policy is not made tamper-resistant.
> 
> Please do not make the best the enemy of the merely better.  Often a
> little better is good enough for now.

No need to convince me, see RFC7435.  That said, the current STARTTLS is
quite sufficient for best-effort security and is quite effective at that:

   https://www.google.com/transparencyreport/saferemail/

Roughly 84% of email to/from gmail is TLS protected, which beats the
recent milestone (IIRC reported from Mozilla HTTP telemetry) of 50%
of web traffic using TLS.

The goal of DANE TLS for SMTP is to opportunistically provide downgrade
resistance for TLS to domains that deploy DANE TLSA records for SMTP.
It is up to each domain whether to publish TLSA records for SMTP or not.
If they do, MTA-to-MTA SMTP from a DANE-enabled MTA to the destination
becomes downgrade-resistant and authenticated.

Notable early adopters in include gmx.de, web.de, posteo.de, mailbox.org,
transip.nl, domeneshop.no, comcast.net, ...

-- 
	Viktor.