3 ms·
That's incorrect. Mail submission using SSL on port 465 is no more secure than using STARTTLS on port 587. If my client connects to my server on port 587 and do
by mike-cardwell 12y ago
That's incorrect. Mail submission using SSL on port 465 is no more secure than using STARTTLS on port 587. If my client connects to my server on port 587 and does an EHLO and sees no mention of STARTTLS in the response, or can't negotiate encryption for any other reason, then it will not continue, not authenticate, and not send email. That is normal behaviour for mail clients that have been configred to use encryption. I'm not aware of any mail clients which will automatically downgrade to not use encryption when configured to use encryption.
- BuildTheRobots 12y agoIt's also worth pointing out that if its your mail _server_ then you can also configure similar. My exim setup doesn't even present the user with LOGIN options until after they've started TLS, so even with a bad client its impossible for them to leak their credentials.
- mike-cardwell 12y agoNot quite. When the MITM strips out "STARTTLS" from the EHLO response, they could also add "AUTH PLAIN", causing your theoretical "bad client" to attempt authentication.
- feld 12y agoThis is what I was trying to get at. It's silly to even offer plaintext communications in the first place.
- mike-cardwell 12y agoWe were talking about a theoretical bad client. No client I have ever used to talk to port 587 would behave that way. They would all encrypt or fail. Regardless of if "AUTH PLAIN" was inserted prior to encryption and/or STARTTLS removed.