<div dir="auto">My take would be that for a general service provider, like TPG, you should be as accepting as possible. That would including accepting clear text and TLS 1.0 (although possibly not SSLv3). Any specific sender or recipient can enforce stronger limitations if they choose to do so.<div dir="auto"><br></div><div dir="auto">For a provider that has any focus on security it's potentially a different story. In that case enforcing TLS1.2 potentially makes sense, although it the raises the question around what you do with servers that don't support TLS at all, or like TPG at the moment, don't support TLS higher than 1.0 (is cleartext better than TLS1.0?)<br><div dir="auto"><br></div><div dir="auto">Then there's the elephant in the room when it comes to SMTP around certificate verification, and if/how you determine your talking to the correct mail server (at which point you have to move the conversation over to things like DNSSEC)</div><div dir="auto"><br></div><div dir="auto"> Scott</div><div dir="auto"><br></div><div dir="auto"><br></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Jul 24, 2018, 09:48 Paul Wilkins <<a href="mailto:paulwilkins369@gmail.com">paulwilkins369@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Should TLS 1.0 be acceptable?</div><div><br></div><div>I don't claim to be a crypto geek.</div><div><br></div><div>Curiously the ISM standards make TLS 1.2 only advisory:</div><div><br></div><div><ul><li>Control: 1447; Revision: 0; Updated: Apr-15; Applicability: UD, P, C, S, TS; Compliance: must; Authority: AA</li><ul><li>Agencies <b>must use TLS</b>.</li><li><br></li></ul><li>Control: 1139; Revision: 3; Updated: Apr-15; Applicability: UD, P, C, S, TS; Compliance: should; Authority: AA</li><ul><li>Agencies <b>should use the latest version of TLS</b></li></ul></ul>Kind regards<div class="m_-2151073009425191506gmail-yj6qo m_-2151073009425191506gmail-ajU"><div id="m_-2151073009425191506gmail-:qs" class="m_-2151073009425191506gmail-ajR"><img class="m_-2151073009425191506gmail-ajT" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div></div><span class="m_-2151073009425191506gmail-HOEnZb m_-2151073009425191506gmail-adL"><font color="#888888"><br>Paul Wilkins</font></span><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 24 July 2018 at 11:10, Scott Howard <span dir="ltr"><<a href="mailto:scott@doc.net.au" target="_blank" rel="noreferrer">scott@doc.net.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span>On Mon, Jul 23, 2018 at 6:00 PM, Noel Butler <span dir="ltr"><<a href="mailto:noel.butler@ausics.net" target="_blank" rel="noreferrer">noel.butler@ausics.net</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="font-size:10pt"><div dir="ltr">
You are the one choosing to use cpanel/plesk, lazy webhost solutions that puts all your customers eggs in the one single basket (though I heard plesk may soon be changing that), sorry, but that is not TPG's fault your chosen hosting software lives in the 90s.</div><span class="m_-2151073009425191506m_-1051376555541353626gmail-HOEnZb"><font color="#888888">
<div></div></font></span></div></blockquote><div><br></div></span><div>Perhaps not, but it IS TPG's fault that their mail server is only supporting encryption algorithms that live in the 90's...</div><div><br></div><div>Irrespective of the PCI argument or not, TPG supporting TLS 1.0 but not higher in 2018 simply shouldn't be seen as acceptable.</div><span class="m_-2151073009425191506HOEnZb"><font color="#888888"><div><br></div><div> Scott</div><div><br></div></font></span></div></div></div>
<br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank" rel="noreferrer">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank" rel="noreferrer">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote></div>