thunderbird-android
thunderbird-android copied to clipboard
Improve SSL connection handling
While working on #7655 I noticed that we use a quite dated implementation to establish SSL connections. As we would like to raise the bar in terms of security (level needs to be decided). This is a good starting point for improvements.
The classes to look at:
DefaultTrustedSocketFactoryimplementation ofTrustedSocketFactoryfor all mail backends- creates it's own
SSLcontextand injectsTrustManagerFactoryandKeyChainKeyManager
- creates it's own
TrustManagerFactory- internally uses a customSecureX509TrustManagerwhich is error prone and not advisedKeyChainKeyManager- Android 4.0 KeyChain API
These need to be evaluated and updated to latest security best practises or replaced by a solid and secure 3rd party solution. Also they are lacking any tests, it would be advised to add them to protect against accidential behavior changes and verify that it works as intended. Also there is no documentation describing the intended behavior.