Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

can you tell me if there are any differences between POP3S and POP3 with STARTTLS?

What's the safest? Are there any known attacks?

If you could choose about them, which would you pick? Thanks a lot

share|improve this question
1  
Can you update your question with some context - what are you wanting to use them for? It may help people answer. – Rory Alsop♦ Nov 13 '12 at 14:28
1  
@RoryAlsop Download new mail ;) – Surfer on the fall Nov 13 '12 at 20:49

1 Answer

up vote 5 down vote accepted

The only difference is that with old-style SSL, it is implied that you will start SSL negotiation immediately upon connection. With STARTTLS, you go through the same process, but only after issuing/receiving a STARTTLS command. The protocols are designed to throw away any information discovered or negotiated before the connection was secured, and start over again from scratch.

share|improve this answer
One caveat: any information sent over the connection before SSL/TLS is initiated is, obviously, visible to any appropriately-positioned onlooker. Typically these protocols don't say anything of substance before the go secure, but it's still worth pointing out. – tylerl Nov 16 '12 at 7:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.