[jira] [Commented] (GERONIMO-6793) Do not auto-enable all available Cyphers in TLS/SSL protocol handling in MailConnection

["Richard Zowalla (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GERONIMO-6793?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17354824#comment-17354824 ] 

Richard Zowalla commented on GERONIMO-6793:
-------------------------------------------

Provider scanning is maybe an enhancement / follow-up.

We would need to gather a list of prominent mail providers first (Gmail, Yahoo, Outlook, AOL, Zoho, Mail.com, ProtonMail, ...) - there might be others around. Scanning the ciphers itself can be done in bulk via testssl.sh (for example) , which can store JSON and subsequently parsed to get an aggegated cipher list.

Possible problem would be, that the ciphers are subject to change - so we would need to monitor them reliably (if they are hard-coded)

> Do not auto-enable all available Cyphers in TLS/SSL protocol handling in MailConnection
> ---------------------------------------------------------------------------------------
>
>                 Key: GERONIMO-6793
>                 URL: https://issues.apache.org/jira/browse/GERONIMO-6793
>             Project: Geronimo
>          Issue Type: Improvement
>      Security Level: public(Regular issues) 
>          Components: mail
>            Reporter: Richard Zowalla
>            Priority: Major
>
> Check and discuss, if it is a good idea to enable all cyphers in TLS/SSL protocol handling in MailConnection.java 
> Some cyphers are deprecated for good reasons and shouldn't be used.
> This enhancement might possibily include
>  * Allow users to specifiy cyphers via properties (custom factory is already possible)
>  * If we have no user defined cyphers available, fallback to the JVMs default cyphers.
>  
> This is a follow up issue raised from the discussion on the dev mailing list, see http://mail-archives.apache.org/mod_mbox/geronimo-dev/202012.mbox/%3C096fbb867eda8e090eddf80fbd81cf787ac87945.camel%40hs-heilbronn.de%3E



--
This message was sent by Atlassian Jira
(v8.3.4#803005)