3

Assume Mallory knows the server, username and password that Alice uses to send email via smtp. Can Mallory read Alice's email? Does it depend on the specific system or configuration?

Improve this question
1
  • Are you asking whether SMTP credentials can always be used to access IMAP/POP?
    – Fire Quacker
    Commented Jan 22, 2020 at 17:51

2 Answers 2

Reset to default
2

Many ISP-hosted outgoing SMTP servers simply provide relaying of outgoing messages, without providing any type of mailbox functionality and/or message storage and retrieval functionality. If that's the case - then, if Mallory has Alice's username and password for the SMTP server, then Mallory would be able to send messages through Alice's account, but Mallory would not be able to access messages that Alice has sent through the server.

But, all bets are off if the SMTP server also has mailbox functionality or message storage and retrieval functionality, or integrates with an IMAP server, or the like, (or if Alice uses the same username and password for her POP3 or IMAP server).

Improve this answer
4

Maybe.

It depends on what controls there are. Credentials alone will not work if:

  • processes limit which IPs can connect
  • processes look for anomalies in what is connecting
  • Multi-factor authentication
  • the credentials are only for sending and not accessing mailboxes
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .