Owncloud-client does not verify TLSA-record (DANE)

owncloud / client

🖥️ Desktop Syncing Client for ownCloud

GNU General Public License v2.0

1.4k stars 663 forks source link

Owncloud-client does not verify TLSA-record (DANE) #6521

Open wioxjk opened 6 years ago

wioxjk commented 6 years ago

Expected behaviour

Owncloud Client should verify TLSA record

Actual behaviour

Owncloud Client does not verify TLSA record

Steps to reproduce

Set up a invalid TLSA record

######################

It seems that the Owncloud-client does not verify DANE (TLSA-record).

ckamm commented 6 years ago

Yes.

This would be done in upstream libaries. The only Qt related issue I found was https://bugreports.qt.io/browse/QTBUG-54682 .

But it doesn't seem like DANE has received significant adoption, as far as I can tell neither Firefox or Chrome use it yet.

wioxjk commented 6 years ago

I am aware of that the adoption of DANE is slow :) But it would be a nice security feature for Owncloud to have that support. If Owncloud adds support for it - more will follow.

guruz commented 6 years ago

CC @peter-ha @richmoore

peter-ha commented 6 years ago

Chromium said "won't fix" years ago: https://bugs.chromium.org/p/chromium/issues/detail?id=50874#c22

wioxjk commented 6 years ago

@peter-ha Since when did Chromium decide what the Owncloud cloud should implement? Also, that is almost 5 years ago. The internet has change alot since then.

Encryption is trending nowadays, and owncloud should set a example.

peter-ha commented 6 years ago

meh

richmoore commented 6 years ago

wioxjk commented 6 years ago

Atleast I hope you will give that option to us enterprise customers.

michaelstingl commented 6 years ago

@wioxjk enterprise customers please get in touch with enterprise support or your account manager. (https://owncloud.com/contact/)