[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]
On Wed, 2026-10-21 at 13:38 +0100, giles@xxxxxxxxxxx wrote: > TLS is used a lot more than just websites. Many B2B API > communications rely > on it, and this provides a massive MiTM attack much easier to > exploit. Oh I know, previous company did XMPP which did channel binding with TLS. But as I said most of this comes down to apply the security update, which will refresh the certificate stores. Also people should be aware that some of the backend TLS is pretty poor at checking certificates. If it matters check it actually enforces the certificate is correct. Looking at you email, but also old versions of some big name free software databases, and some worked but you had to specifically tell it you cared about certificates being valid on TLS (presumably they were assuming if you use TLS internally you were using private certs and weren't competent to sign them properly (sigh)). Last time I was checking Google Mail you had to tell it to insist on a certificate from specific sender domains, and that it be a valid certificate. I believe it was moving to requiring a valid certificate if it had ever seen one before for that domain, so a sort of "encrypt properly after first use" model, which makes a lot of sense to ratchet up email security. But yes patch all the things, and makes sure you get the TLS and PHP updates..... -- The Mailing List for the Devon & Cornwall LUG FAQ: https://www.dcglug.org.uk/faq/