From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.bugs Subject: bug#16978: 24.3; SSL/TLS with multiple man-in-the-middle vulnerabilities Date: Mon, 17 Mar 2014 17:06:08 -0400 Organization: =?UTF-8?Q?=D0=A2=D0=B5=D0=BE=D0=B4=D0=BE=D1=80_?= =?UTF-8?Q?=D0=97=D0=BB=D0=B0=D1=82=D0=B0=D0=BD=D0=BE=D0=B2?= @ Cienfuegos Message-ID: <878us88ri7.fsf@lifelogs.com> References: <86siqqv938.fsf@informationelle-selbstbestimmung-im-internet.de> Reply-To: bug-gnu-emacs@gnu.org NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1395090372 27821 80.91.229.3 (17 Mar 2014 21:06:12 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 17 Mar 2014 21:06:12 +0000 (UTC) To: 16978@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Mon Mar 17 22:06:20 2014 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1WPejj-0002rh-Rm for geb-bug-gnu-emacs@m.gmane.org; Mon, 17 Mar 2014 22:06:20 +0100 Original-Received: from localhost ([::1]:60223 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPejj-0002b5-Cr for geb-bug-gnu-emacs@m.gmane.org; Mon, 17 Mar 2014 17:06:19 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:38571) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPejZ-0002at-S4 for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:06:16 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WPejS-0004K9-35 for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:06:09 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:38101) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPejR-0004K5-W6 for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:06:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1WPejR-00053q-Qq for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:06:01 -0400 X-Loop: help-debbugs@gnu.org In-Reply-To: <86siqqv938.fsf@informationelle-selbstbestimmung-im-internet.de> Resent-From: Ted Zlatanov Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Mon, 17 Mar 2014 21:06:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 16978 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.139509035519440 (code B ref -1); Mon, 17 Mar 2014 21:06:01 +0000 Original-Received: (at submit) by debbugs.gnu.org; 17 Mar 2014 21:05:55 +0000 Original-Received: from localhost ([127.0.0.1]:39283 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WPejK-00053S-9M for submit@debbugs.gnu.org; Mon, 17 Mar 2014 17:05:54 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:36787) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WPejH-00053I-FE for submit@debbugs.gnu.org; Mon, 17 Mar 2014 17:05:52 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WPejA-0004Eg-7y for submit@debbugs.gnu.org; Mon, 17 Mar 2014 17:05:51 -0400 Original-Received: from lists.gnu.org ([2001:4830:134:3::11]:37375) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPejA-0004Ec-5K for submit@debbugs.gnu.org; Mon, 17 Mar 2014 17:05:44 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:38457) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPej3-0002MQ-5H for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:05:43 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WPeiv-0004C3-Nl for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:05:37 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:45628) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WPeiv-0004Bw-HC for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 17:05:29 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1WPeis-0001q9-00 for bug-gnu-emacs@gnu.org; Mon, 17 Mar 2014 22:05:26 +0100 Original-Received: from c-98-229-61-72.hsd1.ma.comcast.net ([98.229.61.72]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 17 Mar 2014 22:05:25 +0100 Original-Received: from tzz by c-98-229-61-72.hsd1.ma.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 17 Mar 2014 22:05:25 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: bug-gnu-emacs@gnu.org Original-Lines: 41 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: c-98-229-61-72.hsd1.ma.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6; d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" Mail-Copies-To: never User-Agent: Gnus/5.130008 (Ma Gnus v0.8) Emacs/24.3.50 (gnu/linux) Cancel-Lock: sha1:5gLgwqeniD4soubkbyvEMOnyAh8= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:86922 Archived-At: On Mon, 10 Mar 2014 07:52:43 +0100 Jens Lechtenboerger wrote: JL> I don't find that acceptable. I vote to ship Emacs with certificate JL> checking by default. Hi Jens, that's how it's planned, but please realize we have to be careful with the large population of Emacs users that would be surprised by sudden failures. So 24.4 is the first version where we'll start doing this. JL> gnutls-cli --tofu opens a TLS connection and asks whether the JL> certificate can be trusted. If so, it is added to JL> ~/.gnutls/known_hosts. On subsequent connections, the presented JL> certificate is compared against the stored one; in case of JL> mismatches, the user is asked whether to trust the new one. To JL> prevent the process from hanging while waiting for the user's reply, JL> option --strict-tofu (introduced in GnuTLS 3.2.12) can be used. JL> I'm describing my view on certificate pinning in general and some JL> details on TOFU with GnuTLS in more detail in my blog: JL> https://blogs.fsfe.org/jens.lechtenboerger/?p=208 That's wonderful, but please realize this doesn't work for Emacs because often, interactive prompting would not be available. The consensus so far has been to abort the connection and tell the user how to allow a host specifically. Can you suggest a cleaner way, perhaps using TOFU with some C automation? (`gnutls-cli' should not be assumed to be available) JL> For Emacs, here is my personal workaround (a real fix would JL> probably require a unified, secure-by-default treatment of TLS JL> throughout all libraries): I appreciate all your review. It's too late to make these changes for 24.4, but I think if you can review the state of things in 24.4, maybe we could discuss an expedited 24.5 release with security fixes (that would be up to the Emacs maintainers, of course). Thanks Ted