7 ms·
This is more likely an abuse mitigation than intentional surveillance. I helped out in the dorms and student machines were constantly infected with malware, som
by kogir 11y ago
This is more likely an abuse mitigation than intentional surveillance. I helped out in the dorms and student machines were constantly infected with malware, some of which sent tons of spam.
I'd be very surprised if correctly configured SMTP using TLS is intercepted.
- zbjornson 11y agoAbuse mitigation may have been the (original) intent. However, it prevents sender verification because stanford.edu is not a designated sender for the external domains, and thus has no SPF records. If I use SMTP to send via gmail with SSL/TLS over port 587, the headers show it hopping through 5 stanford.edu servers, and finally `spf=softfail (google.com: domain of transitioning xxx@gmail.com does not designate (a stanford IP) as permitted sender)`.
- kogir 11y agoFor this to work, either your mail client is not enforcing TLS be used, is not validating the certificates presented to it, or trusts Stanford's MITM certificate. Perhaps you should try port 465 with forced SSL. Stripping TLS is unforgivable. Shame on them.
- revelation 11y agoThe problem with SMTP is the broken-by-design STARTTLS mechanism that allows a hostile network like here to trivially strip the encryption. Been some time since I used a desktop email client, so I'm unsure if clients have now been upgraded to reject sending mails to/through servers that don't do STARTTLS. But I'm guessing no.
- jcranmer 11y agoThunderbird changed years ago to not allow soft-fallback for STARTTLS (i.e., if you request to use STARTTLS, and it's not available, it aborts the connection). I'm pretty sure that the account config also doesn't let you set up connections without STARTTLS or SSL without clicking through scary red this-is-not-safe dialogs, although I don't know if that's only for incoming or if it's for outgoing as well.
- schoen 11y agoIt's probably not (currently) checking the cert validity because the huge majority of STARTTLS certs, unlike HTTPS certs, are self-signed, so a slightly brave but maybe not that brave attacker could allow STARTTLS but MITM the connection with its own self-signed cert.
- chinathrow 11y agoSure it checks that and it alerts the user properly - you then can have it remembered as trusted once and the next connection goes through fine.
- schoen 11y agoThat behavior is pretty nice and is probably yielding a lot of real-world security benefit!
- jcranmer 11y agoThunderbird checks cert validity. Actually, it's gotten more difficult to use an invalid cert, since the core Gecko code changed the invalid cert dialog to remove the ability to easily import the certificate into the NSS database. It's sometimes quite helpful to built on the codebase that invented SSL.
- fanf2 11y agoThe validity of TLS certificates on message submission servers is much better than for MX servers.