New answers tagged

3

There is no weakness in the SMTP protocol itself, but there is a problem of trust. You can send a letter by snail mail and simply write a different sender on the letter. The letter will still be delivered to the recipient even if the sender is spoofed. And exactly the same can be done with SMTP, which is just the electronic way of delivering letters. The ...


3

That specific GMail account flag simply allows system that uses standard SMTP to connect without using OAUTH2. The only secure password authentication method gmail allows SMTP clients to use is a (non.standard) XOAUTH2 SASL mechanism (the correct tag is actually OAUTHBEARER). GMail has decided to refuse all other secure login mechanism: you're either using ...


1

I don't want to change my gmail security settings. Is there any way to make an OpenSSL session meet google's security requirements? In theory you could probably do all the necessary communication with openssl. In practice this will probably too hard to do everything by hand. What you would need to do is to use oauth for the authentication, see ...


1

The problem that you are describing is known as spoofing, where you are able to send a message from personA@company.com, even though you are not personA@company.com. Because the SMTP protocol dates back to the early 1980's, when the internet was in its early stages and used only by a relatively small number of users, the engineers of the SMTP protocol did ...


1

It looks to me that someone is running an smtp-auth attack against us, correct ? What you see in the logs is a failed login attempt. You might have to find out yourself, if that came from one of your employees or a possible attacker. I don't understand why after the Auth Login command i see the 334 and not the Base64 encoded user and password ? ...



Top 50 recent answers are included