Tag Info

New answers tagged

0

This is an old question, but I wanted to add an updated answer for anyone searching and finding this, but using a more modern version of ejabberd (14.12 at the time of this writing). The following options (in the new YAML configuration format) should make starttls required, change the ciphers list to something decent, and disable legacy SSL support for s2s ...


3

The answer, based on the STARTTLS RFC for SMTP (RFC 3207) is: STARTTLS is less secure than TLS. Instead of doing the talking myself, I will allow the RFC to speak for itself, with the four relevant bits highlighted in BOLD: A man-in-the-middle attack can be launched by deleting the "250 STARTTLS" response from the server. This would cause the ...



Top 50 recent answers are included