search

hardenize / hardenize-public

11 stars 0 forks source link

MTA-STS check? #30

Closed wioxjk closed 6 years ago

wioxjk commented 6 years ago

Do you plan to implement MTA-STS check too?

https://aykevl.nl/apps/mta-sts/ https://www.ietf.org/proceedings/98/slides/slides-98-uta-sts-update-00.pdf https://datatracker.ietf.org/doc/draft-ietf-uta-mta-sts/

Darkspirit commented 6 years ago

Article 32 (1) b) EU GDPR (comes into force on 25 May 2018) and §13 (7) german Telemediengesetz (already in force) demand state of the art protections - including encryption - anyway.

The current problem is that http://www.postfix.org/postconf.5.html#smtp_tls_security_level makes it impossible to properly configure postfix: For some domains, one might want to configure dane-only. That's fine. As default configuration one had to use dane with a fallback to verify. (Currently dane falls back to may.) For the time being you would probably have to decide between dane-only for some domains and verify as default configuration.

MTA-STS is based on the assumption that sometimes you would transmit emails without encryption. That would be only allowed if you would enforce the use of PGP or S/MIME and delete all other individual-related data from an email. From my point of view, it makes no sense to build MTA-STS into Postfix. Just always enforce StartTLS and send people their Hardenize link to make them aware of their problems.

This obligation only affects people who process emails from EU citizens. Hopefully some law firms will demand cease and desist declarations and spread fear among lawbreakers.

wioxjk commented 6 years ago

@Darkspirit I think you are referring to ePR that is also is going come into effect 25 May 2018 - ePR and GDPR should not be confused with each other.

https://www.itgovernance.co.uk/eprivacy-regulation-epr

Anyway, The reason I would like to see MTA-STS check is the reason @Darkspirit is saying. Unfortunately, postfix or other MTA's does not support MTA-STS yet and they do not have an ETA. But providers like google, yahoo and microsoft (in a near future) is already using it.

You can basically say - DANE is per server, and MTA-STS is per domain. So if you have a big organisation you should consider do both.

ivanr commented 6 years ago

@wioxjk Yes, we will be adding support for MTA-STS when the specification stabilises. I check their progress ocassionally; the last time I did I felt they were still making substantial changes.

ivanr commented 6 years ago

Just a quick update: MTA-STS has been approved and we'll be looking at it shortly.

wioxjk commented 6 years ago

Great! Looking forward to testing it :)

ivanr commented 6 years ago

Here it is: https://www.hardenize.com/blog/mta-sts Bug reports welcome! :)