Email SSL security?

Question

I use IMAP and I only access my email through SSL.

However, the settings for encrypted email access seem a bit more complicated that https. Can someone explain the security implications of the different combinations? I'll use the available settings from Thunderbird as an example:

IMAP security:

• Connection: None | STARTTLS | SSL/TLS
• Authentication: Normal password | Encrypted Password | Kerberos | NTLM | TLS Certificate

SMTP security:

the same

I have put the options I use at one of my addresses in bold. I'm specifically interested if this combination is secure, but an outline of what the other stuff means would also be great!

Answer 1

Summary

Select STARTTLS or SSL/TLS on connection. Unless told otherwise by your administrator use normal password on authentication.

If your connection is secure, the password may be sent unencrypted through the encrypted connection.

If the connection is not secure, using a secure authentication keeps your password protected. But it may allow an attacker to take over your tcp-connection and do anything within the connection that you can do: read mails, move them around, delete them, flag them, etc.

Connection

none: Unencrypted connection, do not use

ssl/tls: Start a secure connection on a IMAP port dedicated to secure connections (993). This is similar to https.

starttls: The connection is done on the traditional IMAP port (143) but one of the first commands is STARTTLS, which means starting encryption just like TLS/SSL.

Authentication

Normal password: Unencrypted password. This is okay, on a secure connection

Encrypted Password: The password is encrypted somehow. There are different standards.

Kerberos: Kerberos is a single sign on infrastructure. If your computer and the mailserver are member of the same trust domain, Kerberos allows you to access you mails based on your operating system domain login.

NTLM: Similar to Kerberos but Microsoft specific

TLS Certificate: In most cases only the server has a key pair and a certificate to prove its identity. But this approach can be applied on the client as well. That's especially interesting if the private key is stored on a smart card.