Re: A couple of questions and concerns about Emacs network security

[Jimmy Yuen Ho Wong]

On Mon, Jul 9, 2018 at 2:44 PM Lars Ingebrigtsen <address@hidden> wrote:
>
> Jimmy Yuen Ho Wong <address@hidden> writes:
>
> > I thought about this, but there's no standard that bans TLS 1.1, nor
> > TLS client implementations that disabled it by default. Besides, all
> > the problems TLS 1.1 has is already checked by the other checks. This
> > reason I'm checking for TLS 1.0 is somewhat arbitrary, as all the
> > problems it has is already checked by other checks too. So maybe even
> > checking for 1.0 is already too strict, but PCI DSS does ban it, so...
>
> For those who don't understand security acronym soup, the latter means
> "Payment Card Industry Data Security Standard".
>
> And I don't think that's the level we should be considering for Emacs,
> even at the "high" level, because it's pretty...  excessive.  Last time
> I checked.
>

The only TLS requirement in PCI DSS is to use TLS 1.1 and above.
There's no other requirement that I'm aware of.