Re: [Uta] What's the right thing to do about Port 465?

[Keith Moore <[e-mail]>]

On 03/11/2014 06:24 AM, t.p. wrote:
> In terms of getting from where we are to where we want to be, ports are
> realistically the only option, for anything that affects the end user
> with their PC.
>
> All the PCs I have had to configure have allowed me to put in a port of
> my choosing whereas if they were not shipped with a STARTTLS or SRV-ID
> option, then it is unlikely to happen soon (or ever).  Last I saw 20% of
> users accessing web sites were on Windows XP - out of currency 8th April
> 2014 - so anything requiring a software upgrade is likely to involve a
> migration lasting a decade.

I agree that we should expect a long-term migration before all users are 
safely out of the worst combinations of user-agent, configuration, 
TLS/SSL implementation, etc.   I don't think that should  change what we 
recommend as best or standard practice.  But we need to realize that 
both clients and servers that conform to the new standards will need to 
be configurable to interoperate with servers and clients (respectively) 
that are in use today, for many years to come.

For example, this means that servers that meet our recommendations are 
going to need to be configurable to support RC4, old versions of TLS, 
STARTTLS, deprecated/disfavored ports (if we decide that there are any), 
old certificate subject name conventions, and even cleartext, for some 
time.   And the situation is almost as bad for clients that meet our 
recommendations, but hopefully such clients will "latch" better 
capabilities as they become available, stop using these protocols and 
ciphersuites for existing configurations, and warn users about 
establishing new configurations that use them.

Keith