thunderbird / thunderbird/thunderbird-android
Improve SSL connection handling
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
While working on #7655 I noticed that we use a quite dated implementation to establish SSL connections. As we would like to raise the bar in terms of security (level needs to be decided). This is a good starting point for improvements.
The classes to look at:
DefaultTrustedSocketFactoryimplementation ofTrustedSocketFactoryfor all mail backends- creates it's own
SSLcontextand injectsTrustManagerFactoryandKeyChainKeyManager
- creates it's own
TrustManagerFactory- internally uses a customSecureX509TrustManagerwhich is error prone and not advisedKeyChainKeyManager- Android 4.0 KeyChain API
These need to be evaluated and updated to latest security best practises or replaced by a solid and secure 3rd party solution. Also they are lacking any tests, it would be advised to add them to protect against accidential behavior changes and verify that it works as intended. Also there is no documentation describing the intended behavior.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading DefaultTrustedSocketFactory, TrustedSocketFactory, TrustManagerFactory, SecureX509TrustManager, and KeyChainKeyManager to map the current SSL connection behavior. Clarify the required security level before evaluating replacements or updates. Done means the SSL handling is updated, tests cover intended behavior, and documentation describes it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile-dev, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100