thunderbird / thunderbird/thunderbird-android
Drop support for accepting untrusted certificates
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
The topic of how to handle untrusted certificates recently came up again, e.g. in #1818.
I was talking to @eighthave about this today. He suggested to simply drop support for accepting untrusted certificates. And the more I think about it the better i like the idea. It'll remove the choice users are most likely unqualified to make anyway and puts the pressure on the people who maintain the server. The server is the place where the problem needs to be fixed.
In the age of Let's Encrypt everybody has the option to use a valid certificate.
So my question: Is there a good reason why we should keep the ability to manually accept bad certificates?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing #1818 and the 28-comment discussion to determine whether manually accepting untrusted certificates should be removed. The payload names no files, tests, or entry points, so the implementation scope and completion criteria need to be established before work can begin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100