Re: A couple of questions and concerns about Emacs network security

[Perry E. Metzger]

On Mon, 9 Jul 2018 14:33:17 +0100 Jimmy Yuen Ho Wong
<address@hidden> wrote:
> > I see youʼre checking for TLS < 1.1. TLS 1.1 has its fair share of
> > reported issues as well, perhaps we should check for < 1.2 (or we
> > could put that on 'high).
> >  
> 
> I thought about this, but there's no standard that bans TLS 1.1, nor
> TLS client implementations that disabled it by default. Besides, all
> the problems TLS 1.1 has is already checked by the other checks.
> This reason I'm checking for TLS 1.0 is somewhat arbitrary, as all
> the problems it has is already checked by other checks too. So
> maybe even checking for 1.0 is already too strict, but PCI DSS does
> ban it, so...

Yes, this is the correct choice. 1.1 is too widely deployed. Not
allowing 1.0 is quite reasonable, and it would be _nice_ to stop 1.1,
but it would be too disruptive. We should do that only after the
major browsers do the same.

Perry
-- 
Perry E. Metzger                address@hidden