Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?

share|improve this question
1  
Have a read of this answer posted on Server Fault: serverfault.com/a/201521 –  Hammo Jun 21 '13 at 2:23

2 Answers 2

up vote 4 down vote accepted

Yes, it can be read or altered if TLS is not used either between the sender and their mail server, or between the mail servers involved in handling the message, then anyone who is able to see the traffic between them can read or even alter the message in the clear. They would need to have control of a system along the routing of the traffic so it isn't super likely, but it is certainly possible.

It is very difficult to ensure that TLS is used on all links, so if you need security for the message you should encrypt the message on the client prior to sending it.

share|improve this answer
    
I was thinking more like the traffic goes through their router and everything is recorded. –  Griffin Nowak Jun 21 '13 at 2:38
    
Or an offloader. –  AbsoluteƵERØ Jun 21 '13 at 3:07
    
Offloaders would give certificate warnings –  Lucas Kauffman Jun 21 '13 at 6:13
1  
Ack, just realized the main question and actual question in the description are inversions of each other. I answered Yes, the attacker can read the e-mail. I will clarify. –  AJ Henderson Jun 21 '13 at 13:41
    
Note that while TLS may be used on some of the links, it's very hard to assure that it's used on all links (especially when the message is forwarded between mail servers). The best way to guarantee security is end-to-end (i.e. client-to-client) encryption and signing (as in @woliveirajr's answer). –  Gordon Davisson Jun 21 '13 at 15:24

Yes, it can be read very easily. Imagine the following:

your computer -> your ISP -> your email provider -> some router on the internet -> the email provider destination -> his ISP -> his computer

From your computer to his computer, all information is in plain-text. A malicious person in the ISP, or anyone having access to the internet router, etc, can simple read it, without any problems. And you won't even notice it.

To protect the email from readings, you have to encrypt it. So the person will only see what will look random bytes and won't know what you've wrote.

And since the email is in plain-text, it's easy to replace anything inside it, changing some part or the whole thing, and the receiver won't know if it was tempered since you send it. And encryption won't solve that either, if just encryption is used: the malicious person won't know what was written, but can replace the entire email with something else.

To prevent that, you need to sign the email: the signature will assure that it wasn't changed in transit.

combining both (signature + encryption) you can guarantee that no one will read it, and that any change will be noticed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.