Re: Improved TLS Defaults
> The Mozilla defaults are geared towards achieving perfect forward security
> where possible ...
> The RFC, at a minimum, seems a positive change.
Great! This is the goal.
The settings proposed in the RFC are geared towards disallowing anything
that's unabashedly insecure while still maintaining the broadest possible
support by default (to minimize BC implications). I realize that Padraic
isn't suggesting this but I want to state for the record that I don't
believe it makes sense at this time to try to enforce perfect forward
security as a language-level default. However, it *is* important to move
away from the existing naive default and that's what the RFC proposes.
The nice thing here is that the default cipher setting is *exceedingly*
simple to modify in response to future threats or attack vectors; all we'd
need to do to respond to new information going forward is to modify a
single string.
Thread (19 messages)