search

hierynomus / smbj

Server Message Block (SMB2, SMB3) implementation in Java
Other
705 stars 179 forks source link

Enforce security by default #815

Open DHerls opened 6 months ago

DHerls commented 6 months ago

smbj by default does not require message signing and does not encrypt data. This could lead to program authors inadvertently writing insecure software.

The library should have secure defaults and allow users to reduce their security if they need.

hierynomus commented 6 months ago

With these settings you'll also need to remove the supported dialects for SMB2. The goal of the default config is to make it more compatible. I would welcome a second "default setup" which is more secure.

So adding a createSecureConfig()