enforce stronger ciphers in torbirdy
|Reported by:||cypherpunks||Owned by:||sukhbir|
|Severity:||Minor||Keywords:||torbirdy, thunderbird, TorBirdy0.2.2|
The last RFC from 2015 regarding TLS (https://www.rfc-editor.org/rfc/rfc7525.txt) makes
recommendations regarding the use of ciphers, this ciphers are just included in TLS v. 1.2.
4.2. Recommended Cipher Suites
Given the foregoing considerations, implementation and deployment of
the following cipher suites is RECOMMENDED:
These cipher suites are supported only in TLS 1.2 because they are
authenticated encryption (AEAD) algorithms [RFC5116].</i>
Maybe it's a good idea for torbirdy to enforce stronger ciphers and tls v 1.2 (TLS v 1.1 was published in 2006 and TLS v1.2 published in 2008) and only to allow weaker ciphers if the user deliberately changes the setting (eg in "Torbirdy Preferences", checkbox "Allow weak ciphers and TLS downgrade"). Esp. because torbirdy users always face the risk of a malicious exit node, that might try a downgrade attack. And if an email provider in late 2016, still doesn't support the IETF recommendations from 2016 (RFC 7525), maybe it's just not a good idea to use them with torbirdy (by specifically enabling weaker settings, by checking a box, the user should know that it's not the best idea to use this email provider any longer)
Therefore I recommend the following tls/tls-settings for torbirdy's next release.
(I took them from this German site: https://privacy-handbuch.de/handbuch_31k.htm)
security.tls.version.min = 3 enforce tls v 1.2
prevent insecure recognition
strict key pinning