Information Security

Questions tagged [starttls]

Ask Question

The tag has no usage guidance.

17 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
29
votes
2answers
6k views

Why is STARTTLS used when it can be downgraded very easily?

People are making a big fuss about how you absolutely have to disable SSLv3 because TLS can be downgraded to SSLv3 and there is barely a server left on the internet that speaks SSLv3. At the same ...
1
vote
1answer
512 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
1
vote
0answers
181 views

How to Force STARTTLS on Outlook and other clients

I am currently writing an essay about securing E-Mails. Now I'm at the point where I want to know if it´s possible to force STARTTLS in connections via SMTP or POP3/IMAP from the clients' side. I know ...
7
votes
2answers
685 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
0
votes
1answer
193 views

How SSL works in SMTP?

Whenever I see a red lock icon in gmail, I thought the sender doesn't have SSL configured. But one person told me only server (gmail in our case) SSL is enough? Does that mean the sender don't ...
4
votes
2answers
2k views

What happens if STARTTLS dropped in SMTP?

SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows: S: <waits for connection on TCP port 25> C: <opens ...
0
votes
1answer
112 views

Trusting a fraudulent/not trusted CAs for STARTTLS/SMTP

When using STARTTLS for SMTP, should one trust CAs that are not trusted by major browser like for example WoSign or StartCom? As STARTTLS falls back to plaintext it seems an encrypted transmission ...
2
votes
3answers
1k views

What is the purpose of opportunistic TLS (like STARTTLS)?

Opportunistic TLS refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate ...
5
votes
2answers
2k views

Does sending email with TLS help to not being flaged as spam?

Does sending email with TLS help to not being blocked or not being flagged as spam by recipient?
0
votes
1answer
956 views

Sending Mail Using TLS

I run a simple web service, and I need to securely send emails to users via PHP. There are no mailboxes/accounts involved. It is a simple send-only function. Without involving PGP, I have come up ...
2
votes
1answer
136 views

Can STARTTLS protect emails between two organisations?

There are a few threads on STARTTLS but none seem to provide a clear overview of what STARTTLS can and can not do with respect to encrypting email in transit. So my question is, can STARTTLS be ...
3
votes
3answers
172 views

Must mail relays always indicate the use of encryption in the “Received:” header field?

When an email message is sent with transport encryption, you can tell it from the “Received:” field the receiving mail relay adds to the message header. > Received: from [...].google.com ([...]) by > ...
2
votes
1answer
499 views

Initial handshakes of attacks via client-initiated renegotiation

As far as I understand after reading this beautifully explained answer, MiTM data injection attacks via client-initiated renegotiation can only happens if the attacker is already in a connection with ...
16
votes
2answers
25k views

Perfectly secure Postfix MTA (SMTP) configuration

I want to secure my root server (further) service by service, starting with the SMTP service (Postfix MTA) as the most busy one. I the course of setting everything up, I read a lot about security and ...
1
vote
1answer
2k views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
18
votes
5answers
103k views

How can I verify that SSLv3 protocol is disabled?

I'm trying to disable SSLv3 in ejabberd 2.1.10 on Ubuntu 12.04. There is no way to disable it in config file, so I have to patch the source and rebuild the package: https://github.com/processone/...
10
votes
3answers
2k views

Why enable SMTP STARTTLS if OpenSSL is dangerous?

There are a bunch of people in the anti-surveillance movement who are virtually demanding that I enable SMTP STARTTLS support in my environment, in order to enable opportunistic MTA-to-MTA encryption. ...