Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below).
Is the password safely sent through the internet when authenticating using the default settings?
It's hard for me to believe that reputable mail clients, such as Outlook, allow sending passwords in clear text over the internet without any warnings. Is password encryption automatically enforced?
Without a secure connection between your mail client and the mail server, your authentication credentials are sent in the clear - just the same as they would be if you logged into a web site using http instead of https.
This is why many mail providers (such as gmail) only allow the client to proceed with authentication if the client is connected to the server through a secure connection.
Edit in response to comment:
As an example, see the transcript below of an SMTP session with smtp.gmail.com, where the client tries to authenticate with smtp.gmail.com over an insecure connection:
$ telnet smtp.gmail.com 25
Trying 2607:f8b0:4023:1407::6d...
Connected to smtp.gmail.com.
Escape character is '^]'.
s->c: 220 smtp.gmail.com ESMTP i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp
c->s: ehlo test
s->c: 250-smtp.gmail.com at your service, [2001:4801:7822:103:be76:4eff:fe11:923a]
s->c: 250-SIZE 35882577
s->c: 250-8BITMIME
s->c: 250-STARTTLS
s->c: 250-ENHANCEDSTATUSCODES
s->c: 250-PIPELINING
s->c: 250-CHUNKING
s->c: 250 SMTPUTF8
c->s: AUTH LOGIN
s->c: 530 5.7.0 Must issue a STARTTLS command first. i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp
As you can see, the client sent AUTH LOGIN to signal to the server that it wants to attempt to authenticate, but the server responded with a 530 error, 'Must issue a STARTTLS command first'. smtp.gmail.com only allows the client to proceed with authentication if a) the client connects to the server securely by TLS (on port 465), or b) the client connects initially over an insecure connection on port 25 or 587, then upgrades the insecure connection to a secure connection using the STARTTLS command.
