From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: A couple of questions and concerns about Emacs network security Date: Sun, 08 Jul 2018 18:18:01 +0300 Message-ID: <834lh9iwnq.fsf@gnu.org> References: <83o9g2uhju.fsf@gnu.org> <20180705115826.73c1d95e@jabberwock.cb.piermont.com> <878t6lom8g.fsf@mouse.gnus.org> <83601pixph.fsf@gnu.org> NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1531062995 22330 195.159.176.226 (8 Jul 2018 15:16:35 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sun, 8 Jul 2018 15:16:35 +0000 (UTC) Cc: larsi@gnus.org, emacs-devel@gnu.org To: Jimmy Yuen Ho Wong Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Sun Jul 08 17:16:31 2018 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fcBQM-0005jX-De for ged-emacs-devel@m.gmane.org; Sun, 08 Jul 2018 17:16:30 +0200 Original-Received: from localhost ([::1]:37305 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcBST-0004YU-JO for ged-emacs-devel@m.gmane.org; Sun, 08 Jul 2018 11:18:41 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:54317) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcBRm-0004Wl-T6 for emacs-devel@gnu.org; Sun, 08 Jul 2018 11:18:03 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fcBRi-0007CU-Rc for emacs-devel@gnu.org; Sun, 08 Jul 2018 11:17:58 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:38280) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fcBRi-0007CQ-NY; Sun, 08 Jul 2018 11:17:54 -0400 Original-Received: from [176.228.60.248] (port=4608 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1fcBRi-0008SI-4G; Sun, 08 Jul 2018 11:17:54 -0400 In-reply-to: (message from Jimmy Yuen Ho Wong on Sun, 8 Jul 2018 15:58:45 +0100) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:227110 Archived-At: > From: Jimmy Yuen Ho Wong > Date: Sun, 8 Jul 2018 15:58:45 +0100 > Cc: Lars Ingebrigtsen , Emacs-Devel devel > > > But, yes, as Eli says, `paranoid' should perhaps do more for non-TLS > > > connections. The question is "what", though, because there's no > > > fingerprint (beyond the host/port number) that we can use to verify > > > that a non-TLS connection is to a previously seen host. > > > > We could look at the browsers for inspiration, perhaps? > > Browsers have only 1 security level I meant for inspiration about what non-TLS checks can be relevant. Whether they should be on 'paranoid' or lower is a separate question.