Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[Yaron Sheffer <[e-mail]>]

It's one thing to "detect" these cases. Such detection is probably more 
effective on the server side, where there are admins that look at log 
files. I agree we should be providing both sides with the information.

It's another thing to recommend that servers always drop such 
connections. I don't think we should do that.

Thanks,
	Yaron

On 09/25/2013 10:00 PM, Bodo Moeller wrote:
>
>     Organizations often enforce weird and misguided policies on their
>     users, e.g. forcing them all to use IE6 so that "legacy
>     applications" do not need to be upgraded. Mind you, those older
>     browsers only speak older SSL/TLS versions and *their* connections
>     will still go through! Employing such middleboxes is just another
>     policy of this type. Is it really our business to counteract the
>     organization's policy?
>
>
> Certainly, because we don't know if "the organization" that's trying to
> downgrade your connection are your local network admins, or a foreign
> government agency.  This doesn't mean there couldn't be a knob allowing
> you (or your admins) to disable the security check, but the protocol
> should have means to detect this kind of problem.
>