12 ms·
Any truth in this? https://www.agwa.name/blog/post/starttls_considered_harmful https://www.agwa.name/blog/post/starttls_considered_harmful
by higherpurpose 12y ago
Any truth in this?
https://www.agwa.name/blog/post/starttls_considered_harmful https://www.agwa.name/blog/post/starttls_considered_harmful
- omh 12y agoFrom that article: Unfortunately, the SMTPS port is only used for the submission of authenticated mail by mail clients. Opportunistic encryption between SMTP servers, which is extremely important for preventing passive eavesdropping of email, requires STARTTLS on port 25 So for the sort of thing that Google are talking about STARTTLS is the only option. Some of the disadvantages aren't such a big deal for large-scale server-to-server transport. But protocol downgrade attacks should certainly be a worry.
- agwa 12y agoThe downgrade concern mentioned in the post is moot with server-to-server SMTP because we have to intentionally allow downgrades to account for old mail servers. The other concerns with STARTTLS still apply to server-to-server SMTP, but since our only options for server-to-server SMTP are STARTTLS or no encryption at all, we have to just use STARTTLS here.