Subject: RFC 2487 [5]: Suggest dropping of "TLS Required"- forbid and extensions of current standards

From: thomas schorpp <[email-masked]>
Date: Sat, 20 Aug 2005 18:59:08 +0200

hi there,

i cant find the appropriate WG list to discuss this.
so i posted it here.

item:

Hoffman                     Standards Track                     [Page 1]

RFC 2487                 SMTP Service Extension             January 1999

5. The STARTTLS Command

   A publicly-referenced SMTP server MUST NOT require use of the
   STARTTLS extension in order to deliver mail locally. This rule
   prevents the STARTTLS extension from damaging the interoperability of
   the Internet's SMTP infrastructure. A publicly-referenced SMTP server
   is an SMTP server which runs on port 25 of an Internet host listed in
   the MX record (or A record if an MX record is not present) for the
   domain name on the right hand side of an Internet mail address.

suggestion:

1. will be dropped
2. standards will be extended with requirement to present valid
approved-CA-signed certificates at using tls with mailservers
3. standards will be extended to require connection with xsmtps first
with fallback to normal smtp or implement a fallforward to xsmpts if a
server/client requires it..

reasons:

- no more state of the art and technology (1999), nearly all products
support tls
- ongoing criminal phishing activity over smtp
- strong and free certificates for everyone availlable at CACert inc., etc.
- ongoing ucbe activity, spammers could be caught and charged more
easily with their certificates as evidence, same to phishers.
- the current state breaks xsmtps networking since theres no method to
notify clients to reattempt with xsmtps.
- expected more systems ressources needed for this are more economical
than current damage from ucbe and phishing
- S/MIME is spreading too slow and unergonomical, risky and too high
effort for simple end users.
- see https, better lets do it on transport layer
- most end users and their certificate trust/intend is controlled mainly
by a well known u.s. software company charging horrent and unreasonable
fees to distribute so even approved CA Certificates cant be easily
mass-provided.
- several local country signature law issues
- information freedom and privacy

... RFC...

y
tom

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 21 Aug 2005 00:10:57 +0200

The most appropriate place is probably [email-masked]

It's mentioned as a SMTP-subject list in the IETF's list of non-WG mailing 
lists.

BTW - I think the change you propose is a Bad Idea; requiring StartTLS 
means that you impose a great deal of hassle on everyone who wants to send 
mail to you, and the term "approved CA" is a can of worms.

                 Harald

--On lørdag, august 20, 2005 18:59:08 +0200 thomas schorpp 
<[email-masked]> wrote:

> - strong and free certificates for everyone availlable at CACert inc.,
> etc. - ongoing ucbe activity, spammers could be caught and charged more

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 21 Aug 2005 21:17:38 +0200

--On 21. august 2005 01:34 +0200 thomas schorpp <[email-masked]> wrote:

> but AICPA or CICA are no "can of worms" ;)
>
> what hassle with tls?
>
> install postfix, etc, get certificate signed and enable - ready.

if you're a private mailserver, and know your technology by heart, easy.
If your domain is "aol.com", or anything where 1 hour of downtime generates 
more than 1000 angry calls from customers?
If your mailserver is a Sendmail with a heavily customized sendmail.cf?
If your mailserver is interfaced to CC:Mail?
If you require your legal department to sign off on any contracts, 
including the one you have to enter into with CACert?

Don't underestimate the work required to upgrade a million mailservers.

(nevertheless, when I get a free 4 hours, I intend to do just what you 
suggest for my own Postfix installation, and offer OPTIONAL TLS-protected 
SMTP... it will be interesting to see if anyone takes advantage of it...)

                         Harald