Re: [TLS] The risk of misconfiguration

[Stephen Farrell <[e-mail]>]

Good stuff. And thanks to FB for measuring and making this
public, be great if they wanted to do this now and then to
see how what trends emerge and/or if others did similarly.

S.

On 14/05/14 03:22, Viktor Dukhovni wrote:
> On Wed, May 07, 2014 at 05:58:35AM +0000, Viktor Dukhovni wrote:
> 
>>> Ask someone "When you send email to someone, who can
>>> read it?".
>>
>> We're talking about TLS in SMTP not who can or can't read stored
>> email.  Whether the man in the street knows it or not, a substantial
>> fraction (estimated 20% and growing) of email traffic is encrypted
>> in transit, just because both ends can simply turn on STARTTLS.
>> I bet this fraction is larger than the fraction of HTTP traffic
>> that is protected inside HTTPS.
> 
> Right on queue:
> 
>     https://www.facebook.com/notes/protect-the-graph/the-current-state-of-smtp-starttls-deployment/1453015901605223
> 
> I was fairly sure my number of 20% was conservative, now Facebook
> measures it at 58%:
> 
>     We found that 76% of unique MX hostnames that receive our emails
>     support STARTTLS. As a result, 58% of notification emails are
>     successfully encrypted. Additionally, certificate validation
>     passes for about half of the encrypted email, and the other
>     half is opportunistically encrypted. 74% of hosts that support
>     STARTTLS also provide Perfect Forward Secrecy.
> 
> It is perhaps time to retire the belief that TLS for email is in
> a "sad state".  Of course it would be nice to also have authentication,
> but for that we need DNSSEC deployment and publication of TLSA RRs.
> 
> An ISP (posteo.de) deployed the first email transport authentication
> "fax-machine" this week:
> 
>     http://www.heise.de/newsticker/meldung/Verschluesselter-Mail-Transport-Posteo-setzt-als-erster-Provider-DANE-ein-2187144.html
> 
> they can now deliver email securely to debian.org, and any day now
> ietf.org, plus a smattering of smaller domains operated by individual
> DANE early adopters (welcome to the club Alyssa).
>