If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
Yes, it can be read or altered if TLS is not used either between the sender and their mail server, or between the mail servers involved in handling the message, then anyone who is able to see the traffic between them can read or even alter the message in the clear. They would need to have control of a system along the routing of the traffic so it isn't super likely, but it is certainly possible.
It is very difficult to ensure that TLS is used on all links, so if you need security for the message you should encrypt the message on the client prior to sending it.
|show 1 more comment|
Yes, it can be read very easily. Imagine the following:
To protect the email from readings, you have to encrypt it. So the person will only see what will look random bytes and won't know what you've wrote.
And since the email is in plain-text, it's easy to replace anything inside it, changing some part or the whole thing, and the receiver won't know if it was tempered since you send it. And encryption won't solve that either, if just encryption is used: the malicious person won't know what was written, but can replace the entire email with something else.
To prevent that, you need to sign the email: the signature will assure that it wasn't changed in transit.
combining both (signature + encryption) you can guarantee that no one will read it, and that any change will be noticed.