forked from nylas/nylas-mail
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[*] Revamp SSL options (including user-facing)
Summary: Previously, the generic IMAP auth screen presented one security option to users: "Require SSL". This was ambiguous and difficult to translate into the correct security options behind the scenes, causing confusion and problems connecting some accounts. This patch does the following: * Separates security settings for IMAP and SMTP, as these different protocols may also require different SSL/TLS settings * Reworks the generic IMAP auth page to allow specifying security settings with higher fidelity. We looked at various different email apps and decided that the best solution to this problem was to allow more detailed specification of security settings and to ease the burden of more options by having sane defaults that work correctly in the majority of cases. This new screen allows users to pick from "SSL / TLS", "STARTTLS", or "none" for the security settings for a protocol, and also to instruct us that they're OK with us using known insecure SSL settings to connect to their server by checking a checkbox. We default to port 993 / SSL/TLS for IMAP and port 587 / STARTTLS for SMTP. These are the most common settings for providers these days and will work for most folks. * Significantly tightens our default security. Now that we can allow folks to opt-in to bad security, by default we should protect folks as best we can. * Removes some now-unnecessary jank like specifying the SSLv3 "cipher" in some custom SMTP configs. I don't think this was actually necessary as SSLv3 is a protocol and not a valid cipher, but these custom configs may have been necessary because of how the ssl_required flag was linked between IMAP and SMTP before (and thus to specify different settings for SMTP you'd have to override the SMTP config). * Removes hard-coding of Gmail & Office365 settings in several locations. (This was a major headache while working on the patch.) This depends on version 2.0.1 of imap-provider-settings, which has major breaking changes from version 1.0. See commit for more info: nylas/imap-provider-settings@9851054 Among other things, I did a serious audit of the settings in this file and "upgraded" a few servers which weren't using the SSL-enabled ports for their provider to the secure ones. Hurray for nmap and openssl. Test Plan: manual Reviewers: evan, mark, juan, halla Reviewed By: juan, halla Differential Revision: https://phab.nylas.com/D4316
- Loading branch information
Showing
11 changed files
with
238 additions
and
100 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.