Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Yoav Nir <[e-mail]>]

I have to disagree with this.

On Feb 10, 2011, at 4:12 AM, Chris Newman wrote:

> I know I'm very late on this topic, but my position differs from others so 
> I'll comment.
> 
> I can not deny that separate-port for SSL is simpler to implement on the 
> server side (having done both). Since the odds of security bugs increases 
> with the amount of code, I must conclude that separate-port SSL is more 
> secure for _implementers_ and _implementations_ for that reason alone.
> 
> However, I believe STARTTLS is more secure for _operators_ and 
> _administrators_. The separate port model creates an illusion that there is 
> a "secure" and "insecure" variant of the protocol and that a single 
> firewall setting magically makes the application secure. In general, this 
> is not true. Most servers have several security settings and the default 
> settings have to compromise between common practice, secure-by-default 
> practice, deployability, management complexity and usability. There is, in 
> general, no way to make a server installation secure for a given site other 
> than to understand the security settings that server provides and set them 
> properly.
> 
> A protocol that uses STARTTLS thus has the advantage of forcing the 
> administrator/operator to look at the server's security settings to make 
> the installation secure, thus increasing the odds of success relative to 
> the separate-port model where an administrator might falsely assume they're 
> done after blocking the non-SSL port.

I think this is a recipe for failure. What you're saying here, is that by using separate ports, you cannot use the firewall to prevent non-secure connections and this forces the administrator to configure the server properly.

There are several things wrong with this:
1. It does not force the administrator to configure the server properly. At best, it forces them to find the "force SSL" checkbox and check it. That has pretty much the same effect as forcing this on the firewall. Some administrators will use any opportunity to configure the server wrong.
2. You underestimate firewalls. Modern firewalls can examine connections and cut them off if STARTTLS is not initiated in time. So the administrator still has the option of "fixing it in the firewall".

In short, you can't force administrators to do the right thing. Ever.