0

Recently I've been studying SMTP and I've wrote a program that uses socket programming to send emails via extended SMTP (RFC2554).

As I understand, in this protocol one sends base64 encoded strings of username and password to the mail server. But since base64 encoding is not encryption, how can I ensure my username and password are not intercepted? What is the solution in practice?

4
  • "Specifically, what should I do if I want to send username and password securely when sending an email using socket programming?" - this part here is a pure programming question and thus off-topic. I've removed it from the question. It could not be answered anyway based on the provided information since it depends on the programming language used and the available TLS libraries. Nov 13, 2020 at 7:37
  • @SteffenUllrich I see. Sorry about that. But is it okay to ask it again if I specify that I am using Python and its socket package? Or should I go to StackOverflow?
    – trisct
    Nov 13, 2020 at 7:42
  • If you have trouble implementing the recommendations from the answer then please ask at stackoverflow.com instead, since these are purely programming related problems. But note that it is expected to show your own attempts first and point out the specific problems you have. Also note there exist already implementations for this in Python. Notably smtplib implements this already and since the code is open you can see how it is done there. Nov 13, 2020 at 7:46
  • See stackoverflow.com/questions/64505/… for some of examples of how to send an email in python, via a secure SMTP connection to an outgoing SMTP server, with authentication.
    – mti2935
    Nov 13, 2020 at 13:34

2 Answers 2

5

This is why these credentials should only be sent over an SMTP connection secured with SSL/TLS (usually on port 465) or STARTTLS (usually on port 587). See an example of how this is done using openssl s_client at https://www.stevenrombauts.be/2018/12/test-smtp-with-telnet-or-openssl/

0

SMTP server may give different EHLO replies initially (over unencrypted connection) and after STARTTLS command (over encrypted connection). It allows to offer different set of authentication methods.

e.g. smtp.gmail.com offers no AUTH methods whatsoever before STARTTLS command.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .