3 ms·

It is absolutely true that SMTP can be sent over plaintext. Many mail systems have opportunistic use of TLS, but they can fall back to plaintext if that’s not a

by orev 2y ago

It is absolutely true that SMTP can be sent over plaintext. Many mail systems have opportunistic use of TLS, but they can fall back to plaintext if that’s not available. A few mail systems require TLS, at the risk of not being able to receive messages (and the big boss yelling about it). A blanket statement that all email is encrypted is just plain false.

spacebanana7 2y ago
That's interesting. I wonder whether an ISP could block traffic using TLS SMTP ports to force opportunistic senders to revert to plaintext. I suspect this may be possible because TLS SMTP uses port 587, rather than 443 like other TLS connections. https://www.cloudflare.com/en-gb/learning/email-security/smtp-port-25-587/ https://www.cloudflare.com/en-gb/learning/email-security/smt...
- Repulsion9513 2y ago
  The SMTP that we're talking about uses port 25, not port 587 (or 465). But yes, an ISP could block the STARTTLS negotiation. Port 587 is submission - an end-user's client talking to their email provider's SMTP server. Port 25 is smtp - your email provider's SMTP server talking to the recipient's email provider's SMTP server. Port 443 is https - not TLS. TLS can operate over any port you like. The port is determined by the service being used, not by the fact that it's TLS.
leni536 2y ago
Do mainstream client silently fall back for SMTP? Thunderbird, Evolution, Outlook, etc... ? Somehow I doubt it. There is also word around that SMTP certificates are often not verified, but I know that's not true for Thunderbird at least. The situation might be different between SMTP servers, but that shouldn't really apply for hotel wifi.
- spacebanana7 2y ago
  Gmail, Exchange and iCloud mail all seem to fall back on plaintext when TLS is unavailable. Apparently gmail displays hazard icons in the UI if an email isn’t sent over TLS. I’ve not found precise documentation about Thunderbird’s behaviour. https://workspaceupdates.googleblog.com/2020/04/improve-email-security-in-gmail-with-TLS.html?m=1 https://workspaceupdates.googleblog.com/2020/04/improve-emai... https://support.apple.com/en-gb/guide/security/sec100a75d12/web https://support.apple.com/en-gb/guide/security/sec100a75d12/... https://learn.microsoft.com/en-us/purview/email-encryption https://learn.microsoft.com/en-us/purview/email-encryption
  - zinekeller 2y ago
    They're asking for the client-to-provider (which tends to be the one vulnerable to these attacks), not provider-to-provider connections (which makes sense, $BUSINESS's on-premise Exchange might not support TLS connections at all).

by orev 2y ago

spacebanana7 2y ago

That's interesting. I wonder whether an ISP could block traffic using TLS SMTP ports to force opportunistic senders to revert to plaintext. I suspect this may be possible because TLS SMTP uses port 587, rather than 443 like other TLS connections. https://www.cloudflare.com/en-gb/learning/email-security/smtp-port-25-587/ https://www.cloudflare.com/en-gb/learning/email-security/smt...

Repulsion9513 2y ago
The SMTP that we're talking about uses port 25, not port 587 (or 465). But yes, an ISP could block the STARTTLS negotiation. Port 587 is submission - an end-user's client talking to their email provider's SMTP server. Port 25 is smtp - your email provider's SMTP server talking to the recipient's email provider's SMTP server. Port 443 is https - not TLS. TLS can operate over any port you like. The port is determined by the service being used, not by the fact that it's TLS.

leni536 2y ago

Do mainstream client silently fall back for SMTP? Thunderbird, Evolution, Outlook, etc... ? Somehow I doubt it. There is also word around that SMTP certificates are often not verified, but I know that's not true for Thunderbird at least. The situation might be different between SMTP servers, but that shouldn't really apply for hotel wifi.

spacebanana7 2y ago
Gmail, Exchange and iCloud mail all seem to fall back on plaintext when TLS is unavailable. Apparently gmail displays hazard icons in the UI if an email isn’t sent over TLS. I’ve not found precise documentation about Thunderbird’s behaviour. https://workspaceupdates.googleblog.com/2020/04/improve-email-security-in-gmail-with-TLS.html?m=1 https://workspaceupdates.googleblog.com/2020/04/improve-emai... https://support.apple.com/en-gb/guide/security/sec100a75d12/web https://support.apple.com/en-gb/guide/security/sec100a75d12/... https://learn.microsoft.com/en-us/purview/email-encryption https://learn.microsoft.com/en-us/purview/email-encryption
- zinekeller 2y ago
  They're asking for the client-to-provider (which tends to be the one vulnerable to these attacks), not provider-to-provider connections (which makes sense, $BUSINESS's on-premise Exchange might not support TLS connections at all).