[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: A couple of questions and concerns about Emacs network security

From: Jimmy Yuen Ho Wong
Subject: Re: A couple of questions and concerns about Emacs network security
Date: Sat, 23 Jun 2018 02:35:07 +0100
User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0

On 23/06/2018 00:33, Lars Ingebrigtsen wrote:
> OK, I've now read the original email message, and there seems to be a
> fundamental misunderstanding.

Ok I see why NSM was written now. It's basically works like browsers
used to work before Snowden. However, while I think the intention was
good, as there are some good checks in there, I think it still falls far
short from ideal.

NSM is heavily dependent on GnuTLS, and it's not particularly good at
presenting NSM good peer status for NSM to do something about it. For
example, leaving all `nsm` and `gnutls` settings at default, this is a
list of URLs where NSM failed to ask me if I wanted to trust the cert.

    (mapcar (lambda (host) (ignore-errors (url-retrieve-synchronously
           "https://revoked.badssl.com/"                  ;; fail, very
           "https://pinning-test.badssl.com/"             ;; fail, very
           "https://sha1-intermediate.badssl.com/"        ;; fail, very
           "https://3des.badssl.com/"                     ;; fail
           "https://mozilla-old.badssl.com/"              ;; fail
           "https://dh480.badssl.com/"                    ;; fail
           "https://dh512.badssl.com/"                    ;; fail
           "https://dh-small-subgroup.badssl.com/"        ;; fail
           "https://dh-composite.badssl.com/"             ;; fail
           "https://invalid-expected-sct.badssl.com/"     ;; fail, a bit

If I set `network-security-level` to `'high`, only the dh480 and dh512
tests passed. At the very least, NSM should ask me for the 3 very
concerning certs. Even if I set `gnutls-algorithm-priority` to
and pinning are still failing. I don't see how you are going to get
around that without reinventing CRL and HPKP in ELISP.
> Perhaps the doc strings of gnutls.el should mention that the variables
> is provides are useful only if you don't use `open-network-stream' and
> call the low-level functions directly...
Yes this is a very good idea. I don't think anybody on Reddit
understands how to twiddle Emacs's network security knobs to make it do
what it's supposed to do.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]