Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Feb 2016 18:05:26 -0800
From: Seth Arnold <>
Subject: Re: STARTTLS for this list?

On Thu, Feb 11, 2016 at 04:05:53PM -0500, Alex Gaynor wrote:
> Not sure if anyone saw, but gmail has been rolling out UI indicators for
> MTAs which don't use TLS:

This seems like shouting at the wrong person about a problem they can't
address. What is the average gmail user supposed to do with this
information? While it draws a parallel to the lock icon in browsers to
indicate HTTPS is used I think this overstates how "secure" an email is
just because it was sent over one hop using STARTTLS.

If Google actually feels STARTTLS is important enough to users to show
them an icon then they should use this as step one and announce step two
is requiring STARTTLS on a specific date. That only works, of course,
if they announce their intention _and_ a date.

> I was surprised to see this indicator on mail from oss-security. Does
> anyone know who has the keys to `` so they can turn on
> STARTTLS for outbound email?

That'd be "listadmin [at] oss [dash] security [dot] openwall [dot] org"

Probably Alexander. :)

It doesn't seem like a top priority to me: STARTTLS solves one set of
problems and introduces a much larger set of problems. I'm not sure any of
the solved problems are actually pressing problems to a public mail list.

Hosting a mail list is already miserable enough (for example, I don't
think mail From: google addresses actually makes to Google users; also, I
don't know how the moderators manage to keep this list spam-free with zero
mistakes, either false positives or false negatives.) -- adding a half-dozen
more reasons why mail delivery can fail is surely not fun.


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.