Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use IMAP and I only access my email through SSL.

However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the different combinations? I'll use the available settings from Thunderbird as an example:

IMAP security:

  • Connection: None | STARTTLS | SSL/TLS
  • Authentication: Normal password | Encrypted Password | Kerberos | NTLM | TLS Certificate

SMTP security:

the same

I have put the options I use at one of my addresses in bold. I'm specifically interested if this combination is secure, but an outline of what the other stuff means would also be great!

share|improve this question
just note encrypted email access is not email encryption, I hope your question is what you are asking. ;) – Jacob Evans Sep 22 '15 at 20:40
@jacob quite aware of that, thanks. – Martin Sep 24 '15 at 7:53
Good, just wanted to be sure. – Jacob Evans Sep 24 '15 at 11:41
up vote 12 down vote accepted


Select STARTTLS or SSL/TLS on connection. Unless told otherwise by your administrator use normal password on authentication.

If your connection is secure, the password may be sent unencrypted through the encrypted connection.

If the connection is not secure, using a secure authentication keeps your password protected. But it may allow an attacker to take over your tcp-connection and do anything within the connection that you can do: read mails, move them around, delete them, flag them, etc.


none: Unencrypted connection, do not use

ssl/tls: Start a secure connection on a IMAP port dedicated to secure connections (993). This is similar to https.

starttls: The connection is done on the traditional IMAP port (143) but one of the first commands is STARTTLS, which means starting encryption just like TLS/SSL.


Normal password: Unencrypted password. This is okay, on a secure connection

Encrypted Password: The password is encrypted somehow. There are different standards.

Kerberos: Kerberos is a single sign on infrastructure. If your computer and the mailserver are member of the same trust domain, Kerberos allows you to access you mails based on your operating system domain login.

NTLM: Similar to Kerberos but Microsoft specific

TLS Certificate: In most cases only the server has a key pair and a certificate to prove its identity. But this approach can be applied on the client as well. That's especially interesting if the private key is stored on a smart card.

share|improve this answer
Excellent! So it seems I'm using the default/OK configuration alright. – Martin Oct 3 '11 at 11:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.