From: Yoav Nir <ynir@checkpoint.com>
To: Chris Newman <chris.newman@oracle.com>
Date: Thu, 10 Feb 2011 09:19:15 +0200
Subject: Re: [TLS] Security concerns around co-locating TLS and non-secure on
 same port (WGLC: draft-ietf-tsvwg-iana-ports-08)
Thread-Topic: [TLS] Security concerns around co-locating TLS and non-secure on
 same port (WGLC: draft-ietf-tsvwg-iana-ports-08)
Thread-Index: AcvI8tQluol13oALTNiL9FBwZWuVOQ==
Message-ID: <D841BE54-6ACC-4677-B8B5-F8F00A8745E4@checkpoint.com>
References: <4CD76B1B.5030308@ericsson.com>
 <D8B3FDB7A62612A570324BEB@nifty-silver.us.oracle.com>
In-Reply-To: <D8B3FDB7A62612A570324BEB@nifty-silver.us.oracle.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Paul Hoffman <paul.hoffman@vpnc.org>, "tls@ietf.org" <tls@ietf.org>,
 tsvwg <tsvwg@ietf.org>
Precedence: list

I have to disagree with this.

On Feb 10, 2011, at 4:12 AM, Chris Newman wrote:

> I know I'm very late on this topic, but my position differs from others s=
o=20
> I'll comment.
>=20
> I can not deny that separate-port for SSL is simpler to implement on the=
=20
> server side (having done both). Since the odds of security bugs increases=
=20
> with the amount of code, I must conclude that separate-port SSL is more=20
> secure for _implementers_ and _implementations_ for that reason alone.
>=20
> However, I believe STARTTLS is more secure for _operators_ and=20
> _administrators_. The separate port model creates an illusion that there =
is=20
> a "secure" and "insecure" variant of the protocol and that a single=20
> firewall setting magically makes the application secure. In general, this=
=20
> is not true. Most servers have several security settings and the default=
=20
> settings have to compromise between common practice, secure-by-default=20
> practice, deployability, management complexity and usability. There is, i=
n=20
> general, no way to make a server installation secure for a given site oth=
er=20
> than to understand the security settings that server provides and set the=
m=20
> properly.
>=20
> A protocol that uses STARTTLS thus has the advantage of forcing the=20
> administrator/operator to look at the server's security settings to make=
=20
> the installation secure, thus increasing the odds of success relative to=
=20
> the separate-port model where an administrator might falsely assume they'=
re=20
> done after blocking the non-SSL port.

I think this is a recipe for failure. What you're saying here, is that by u=
sing separate ports, you cannot use the firewall to prevent non-secure conn=
ections and this forces the administrator to configure the server properly.

There are several things wrong with this:
1. It does not force the administrator to configure the server properly. At=
 best, it forces them to find the "force SSL" checkbox and check it. That h=
as pretty much the same effect as forcing this on the firewall. Some admini=
strators will use any opportunity to configure the server wrong.
2. You underestimate firewalls. Modern firewalls can examine connections an=
d cut them off if STARTTLS is not initiated in time. So the administrator s=
till has the option of "fixing it in the firewall".

In short, you can't force administrators to do the right thing. Ever.=20