I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't scan it. It goes on to say it's encrypted anyways. Should I not use SSL and select "none" in Outlook?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
The various merits of using Avast's SSL aside, even if you use an encrypted email connection between your email client and your server, there is no guarantee that each mail relay will negotiate encrypted connections between themselves as they pass your email along, or are indeed not compromised. There are two other considerations besides the first hop being encrypted to worry about, however. When you authenticate with a mail server, that authentication information is sent when the connection is established. If the connection is unencrypted, depending on the authentication mechanism (and whether it is designed to work over untrusted channels) it may be possible to capture the authentication details. This may allow an attacker to impersonate you and send email on your behalf. The final consideration is that malware on your PC will have an easier time intercepting unencrypted network traffic (and so your authentication details) than encrypted - specifically, it can just generally collect network traffic (regardless of whether another application then encrypts it) rather than having to attack your email client process. It comes down to a risk-based evaluation. If you select "none" for your SSL options, chances are high you're sending authentication data in the clear. If you use Avast's proxy, you must implicitly trust the local system (actually, you must do this anyway). If you don't, you don't benefit from virus scanning of your email, an important threat vector. From a general security standpoint, assuming Avast's proxy is well implemented you should be fine going with that. The benefit of having your email scanned probably outweighs the risk of your loopback traffic being sniffed. Of course, adjust for your risk appetite. |
|||||||||
|
|
When you set up Avast! to protect your e-mail, you configure Avast! to negotiate the SSL/TLS connection on behalf of Outlook, so that it sits between your mail server and the client. This way, it scans the e-mail before Outlook attempts to open it, preventing any 0day exploits that may have been found in the client. See the mail shield server settings within Avast! to set up your mail accounts with SSL. |
|||||||
|
