New answers tagged

0

Well, as you can read above you can use SMTPS and STARTTLS to harden security for SMTP servers while sending mails. MITM can be mitigated with DKIM. DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit. The organization is a handler of the message, either as its originator or as an ...


3

Writing a standard is easy. I thought about this very problem about ten years ago. It comes down to the human/cost factor. How do you convince a billion technologically illiterate people to update their software for no perceived benefit, and convince the thousands of developers across a smattering of platforms to implement this protocol, and millions of ...


48

It's not that hard, why isn't it standard for years? Because that would not have solved the problem that PGP is trying to solve. PGP is an end to end encryption, so if there is any way for the SMTP server to subvert the encryption, then the scheme fails. In the case of the scheme you proposed, suppose Alice (alice@charlie.com) wants to send a private ...


30

integrating PGP into SMTP. PGP is a container format for data (like mails but not restricted to mails), which adds encryption and/or signature to the data. SMTP is a transport protocol. You don't integrate container formats into transport protocols. This would be the same as saying that you should integrate Office (container for text, images...) with ...


3

Encryption is already in place during mail transit (STARTTLS in SMTP), but not sophisticated enough to protect against MITM. I believe PGP is more of an end-user experience between email clients, which is helpful if you don't have full trust of the servers involved. (PGP is sometimes susceptible to MITM to the less-than-careful user, however, like in SSH, ...


4

Bruce brings up some good general advice. I'll address the specifics. The biggest risk you face for SMTP is largely "open relay". That is, someone discovering your server and using it to relay SPAM. It's been a while since I've configured postfix, but in general there's a setting that controls what hosts in your network are allowed to relay email. You ...


4

There are free services that test for remote relay availability (just google for smtp relay test to turn up several) which are going to do the same thing attackers do (attempt to relay mail, watch the result, report back). If you perform a few of these, get their results and can match it up with your log file (to identify why the relay did/didn't work) you ...


3

I'm going to take a careful viewpoint and say that you can't know that in general, and specifically you can't know that for something as complicated as an SMTP setup. The situation is analogous to that of bugs and testing. As Edsger W. Dijkstra once wrote: "Program testing can be used to show the presence of bugs, but never to show their absence!" More ...



Top 50 recent answers are included