Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't scan it. It goes on to say it's encrypted anyways. Should I not use SSL and select "none" in Outlook?

share|improve this question
    
It sounds the Avast Outlook add-on is pretty much useless if its unable to scan an email after you downloaded it to your local machine. –  Ramhound Aug 28 '12 at 12:56
    
I don't think it's an Outlook add-on in the sense that it appears to have no presence in Outlook. It's a module of Avast AV called mail shield and a notification from Avast pops up automatically each time I try to add a new account to Outlook. –  Celeritas Aug 28 '12 at 18:53

2 Answers 2

up vote 2 down vote accepted

Should I not use SSL and select "none" in Outlook?

The various merits of using Avast's SSL aside, even if you use an encrypted email connection between your email client and your server, there is no guarantee that each mail relay will negotiate encrypted connections between themselves as they pass your email along, or are indeed not compromised.

There are two other considerations besides the first hop being encrypted to worry about, however. When you authenticate with a mail server, that authentication information is sent when the connection is established. If the connection is unencrypted, depending on the authentication mechanism (and whether it is designed to work over untrusted channels) it may be possible to capture the authentication details. This may allow an attacker to impersonate you and send email on your behalf.

The final consideration is that malware on your PC will have an easier time intercepting unencrypted network traffic (and so your authentication details) than encrypted - specifically, it can just generally collect network traffic (regardless of whether another application then encrypts it) rather than having to attack your email client process.

It comes down to a risk-based evaluation. If you select "none" for your SSL options, chances are high you're sending authentication data in the clear. If you use Avast's proxy, you must implicitly trust the local system (actually, you must do this anyway). If you don't, you don't benefit from virus scanning of your email, an important threat vector.

From a general security standpoint, assuming Avast's proxy is well implemented you should be fine going with that. The benefit of having your email scanned probably outweighs the risk of your loopback traffic being sniffed. Of course, adjust for your risk appetite.

share|improve this answer
    
Impersonating someone with email is reasonably trivial; no need to have the authentication details. –  Jacco Aug 28 '12 at 8:57
1  
@Jacco yes, but actually having access to valid smtp credentials and a valid email account that'll pass SPF opens you up to social engineering and all sorts of nasties. Chances are the smtp/pop/imap accounts all have the same auth credentials. –  user2213 Aug 28 '12 at 9:02
    
true, having the credentials makes things easier and can result in harder to prove forgery. –  Jacco Aug 28 '12 at 9:26

When you set up Avast! to protect your e-mail, you configure Avast! to negotiate the SSL/TLS connection on behalf of Outlook, so that it sits between your mail server and the client. This way, it scans the e-mail before Outlook attempts to open it, preventing any 0day exploits that may have been found in the client.

See the mail shield server settings within Avast! to set up your mail accounts with SSL.

share|improve this answer
    
Looks ok. There are a few enteries where host name is just an ip address. Any idea how I can figure out if they belong there or not? Some accounts I had added I needed to try to send a few test e-mails before I got things working and I think Avast created rules for each of the wrong settings so there's a lot of crap. –  Celeritas Aug 28 '12 at 7:11
1  
@Celeritas - So wipe the settings and recreate the correct rules. –  Ramhound Aug 28 '12 at 12:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.