4 ms·
At least they are hashing and not storing encrypted passwords. But even a baby framework with may be 10s of deployments have switched to bcrypt, etc. Im not sur
by anaganisk 4y ago
At least they are hashing and not storing encrypted passwords.
But even a baby framework with may be 10s of deployments have switched to bcrypt, etc. Im not sure why they're boasting about SHA512. But I am a little lost on the RFC thing. Could you enlighten me. I thought they were standard ports for legacy,TLS, and SSL ports.
- imp0cat 4y agotldr; 465 is obsolete,you should not use it; 25 is for relaying mail between servers; 587 is the default mail submission port today.
- smorrebrod 4y agoIsn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?
- justsomehnguy 4y ago> since 587 uses STARTTLS and STARTTLS Technically yes, but for the last decade I've seen only one instance where 587 was explicitly STARTTLS (Fastmail), everyone else just running TLS on it.
- smorrebrod 4y agoHow can I check if a connection is TLS or STARTTLS?
- imp0cat 4y agoConnect to the smtp server and issue `EHLO something` command, then check if STARTTLS is mentioned in the server response.
- smorrebrod 4y agoThanks!
- justsomehnguy 4y agoMinor nitpicks: a) you need a plain-text aka telnet client for this b) if you receive a valid, human-readable text then it means what you are not on TLS for sure c) if B succeeds that doesn't means what that SMTP server support STARTTLS, you should check options and try to initite it , eg: 220 smtp.fastmail.com ESMTP ready -> EHLO just.testing.things 250-smtp.fastmail.com 250-PIPELINING 250-SIZE 71000000 250-ENHANCEDSTATUSCODES 250-8BITMIME !! 250 STARTTLS -> STARTTLS 220 2.0.0 Start TLS
- imp0cat 4y agoRight, I guess you could also use openssl's s_client like this: openssl s_client -starttls smtp -connect smtp.gmail.com:587 openssl s_client -connect smtp.gmail.com:465
- pas 4y agosmtp.gmail.com:587 is still STARTTLS.
- account42 4y agoSTARTTLS is a protocol. Allowing unencrypted connections is a policy. One does not imply the other.
- nona 4y agoIs 465 really obsolete? https://www.rfc-editor.org/rfc/rfc8314#section-3.3 https://www.rfc-editor.org/rfc/rfc8314#section-3.3
- imp0cat 4y agoAs the other commenter pointed out, you are right, it once was, but that is no longer the case.
- Avamander 4y agoNo, it is not obsolete, quite contrary actually. See RFC8314. The implicit TLS submission port got deprecated for a brief time, but it's no longer deprecated. Explicit TLS is a terrible idea and for that reason it's recommended to provide implicit TLS (submissions).
- imp0cat 4y agoHey! Thanks for the clarification, looks like an exception was made specifically for smtp. And after reading their reasoning, it does make sense. Server operators should (and do) provide both 486 and 587 in order to maximize the amount of secure connections to their servers.