Re: TLS in Gopher
On 28 Feb 2018, at 10.14, Iain R. Learmonth <irl@fsfe.org> wrote:
>
>
> You could always have a TLS wrapper that is also happy to not do TLS.
True, although I don't know any such existing wrapper. Also as started in RFC3207 STARTTLS is less secure than dedicated port - an attacker can always strip the STARTTLS while dedicated port either connects securely or doesn't connect at all.
Since gopher hardcodes both server names and port numbers (all links are absolute) adding TLS is a pain without breaking the protocol. I know, I've been researching this for a couple of years now. Starttls is the easiest as it doesn't break the protocol but it's also no more secure than current plaintext connections while adding huge libraries to currently very simple servers.
- Kim
> This would allow clients to perform TLS if they wish, or not, and all on
> the same port without complicating any codebases.
>
> Thanks,
> Iain.
>
Reply to: