4 ms·
> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. Tell me you don't know about
by throwaway892238 4y ago
> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords.
Tell me you don't know about password security without telling me you don't know about password security
> SMTP - port 25, 465 (TLS), 587
Tell me you don't follow RFCs without telling me you don't follow RFCs
> https://poste.io/doc/license https://poste.io/doc/license
you are allowed to run unlimited count of instances for your own use only
you can't sell or distribute container images to third parties, every mailserver operator needs to have its own license
Rather take the 3 hours to just set up all that FOSS software myself and give it away to everyone for free but thanks anyway
- anaganisk 4y agoAt least they are hashing and not storing encrypted passwords. But even a baby framework with may be 10s of deployments have switched to bcrypt, etc. Im not sure why they're boasting about SHA512. But I am a little lost on the RFC thing. Could you enlighten me. I thought they were standard ports for legacy,TLS, and SSL ports.
- imp0cat 4y agotldr; 465 is obsolete,you should not use it; 25 is for relaying mail between servers; 587 is the default mail submission port today.
- smorrebrod 4y agoIsn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?
- justsomehnguy 4y ago> since 587 uses STARTTLS and STARTTLS Technically yes, but for the last decade I've seen only one instance where 587 was explicitly STARTTLS (Fastmail), everyone else just running TLS on it.
- smorrebrod 4y agoHow can I check if a connection is TLS or STARTTLS?
- imp0cat 4y agoConnect to the smtp server and issue `EHLO something` command, then check if STARTTLS is mentioned in the server response.
- smorrebrod 4y agoThanks!
- justsomehnguy 4y agoMinor nitpicks: a) you need a plain-text aka telnet client for this b) if you receive a valid, human-readable text then it means what you are not on TLS for sure c) if B succeeds that doesn't means what that SMTP server support STARTTLS, you should check options and try to initite it , eg: 220 smtp.fastmail.com ESMTP ready -> EHLO just.testing.things 250-smtp.fastmail.com 250-PIPELINING 250-SIZE 71000000 250-ENHANCEDSTATUSCODES 250-8BITMIME !! 250 STARTTLS -> STARTTLS 220 2.0.0 Start TLS
- imp0cat 4y agoRight, I guess you could also use openssl's s_client like this: openssl s_client -starttls smtp -connect smtp.gmail.com:587 openssl s_client -connect smtp.gmail.com:465
- pas 4y agosmtp.gmail.com:587 is still STARTTLS.
- account42 4y agoSTARTTLS is a protocol. Allowing unencrypted connections is a policy. One does not imply the other.
- nona 4y agoIs 465 really obsolete? https://www.rfc-editor.org/rfc/rfc8314#section-3.3 https://www.rfc-editor.org/rfc/rfc8314#section-3.3
- imp0cat 4y agoAs the other commenter pointed out, you are right, it once was, but that is no longer the case.
- Avamander 4y agoNo, it is not obsolete, quite contrary actually. See RFC8314. The implicit TLS submission port got deprecated for a brief time, but it's no longer deprecated. Explicit TLS is a terrible idea and for that reason it's recommended to provide implicit TLS (submissions).
- imp0cat 4y agoHey! Thanks for the clarification, looks like an exception was made specifically for smtp. And after reading their reasoning, it does make sense. Server operators should (and do) provide both 486 and 587 in order to maximize the amount of secure connections to their servers.
- AnonC 4y agoI'm not the OP/creator and have no affiliation with it. On the first two points, I thought the snark in this comment could be accepted had it been followed with more useful information and pointers along with the criticism. A one line criticism and attack isn't helping anyone and doesn't help us have "curious conversation" that HN asks users to promote.
- throwaway892238 4y agoNot every comment has to be a lecture from an academic, despite how much the mods want that to boost their forum's rep