85
votes
Accepted
Why does Gmail (add accounts) using SMTP server recommend SSL instead of TLS?
From that link:
Select a secured connection
Check with your other mail service for their recommended port number and authentication type.
Here are some common combinations:
SSL ...
- 11.8k
62
votes
Accepted
How do email clients "send later" without storing a password?
Sparks stores your account credentials on their systems. This is also described in their privacy policy:
INFORMATION WE COLLECT AND HOW WE USE THIS INFORMATION
Auth login or mail server ...
- 208k
47
votes
Accepted
What is the most secured SMTP authentication type?
With SSL/TLS it's okay to use LOGIN / PLAIN.
You should provide SMTP on top of an SSL-encrypted connection. While some schemes from your list (e.g. DIGEST-MD5) can keep a password secure even over an ...
- 45.1k
28
votes
Is there a risk connecting to POP3 or SMTP email server without secure connection?
Is there a risk to sending and receiving emails via without a secure SSL/TLS connection?
The problem is equivalent to using your webmail via plain HTTP. A man-in-the-middle attacker could capture the ...
- 45.1k
18
votes
Is there a risk connecting to POP3 or SMTP email server without secure connection?
pop.orangehome.co.uk
There is in theory support for explicit TLS in POP3 using the STLS command (similar to STARTTLS in SMTP) but this server does not support this command and thus no TLS is possible....
- 208k
12
votes
How do email clients "send later" without storing a password?
Any online service that acts on your behalf with other network services will normally need to store the credentials needed for those other services. While there are other ways to implement ...
- 612
8
votes
Accepted
Can SPF be bypassed by using a shared email server?
SPF is designed to protect against someone using their own server to send e-mail with your from address. For instance, spammers might use a botnet of compromised PCs or devices to connect directly to ...
- 3,920
6
votes
Accepted
Why would an attacker try SMTP login many times even though it is disabled?
Attack code is often a hastily scripted affair, poorly written and without proper error handling. It’s probably only checking for a a 200 OK response, and retrying in case of any non-200 response.
...
- 34.7k
5
votes
It's still possible to email spoofing to Google
First up.. my experience: Im a penetration tester with a lot of phishing simulations under my belt, a lot of which have been targeted at organisations using (hiding behind) Gmail/GSuite.
Gmail's ...
- 488
5
votes
Accepted
How to securely store user-specific mail server credentials at the server side of a web application
Don’t. Don’t take the risk.
Jira, for example, sets the From: <user name> [email protected] and reply to: [email protected]
Then the user sees the right person’s name in the from, replies ...
- 2,386
5
votes
Accepted
SMTP security regarding sending username and password
This is why these credentials should only be sent over an SMTP connection secured with SSL/TLS (usually on port 465) or STARTTLS (usually on port 587). See an example of how this is done using ...
- 24k
5
votes
smtp port 465 login information compromised
As long as you have changed your password since that compromise, you should be fine.
Outbound email on port 465 is SSL-encrypted and outbound email on port 587 (submission) uses TLS (by issuing the ...
- 12.1k
4
votes
Accepted
How to use testssl.sh on an SMTP server?
wget https://testssl.sh/testssl.sh
chmod +x testssl.sh
./testssl.sh --mx <domain name>
works fine.
./testssl.sh -t smtp <ip>:25
and
./testssl.sh -t smtp <ip>:587
also work ...
- 8,654
4
votes
What is the most secured SMTP authentication type?
What I call a nice authentication is one that has the following properties:
the server never has to know the actual password but only keeps a hash of it
This ensures that even if the password ...
- 26.9k
4
votes
Is there a risk connecting to POP3 or SMTP email server without secure connection?
As you speak of your ISP there is normally nothing between your host and your ISP's network. So of course nothing is encrypted but even it you used SSL it would be decrypted before reaching the server ...
- 26.9k
4
votes
Accepted
What are the security issues of having all services (web, smtp, dns) on a single machine?
Other then the amount of resources all these services on one machine will take up, you will need to worry the most about one of them being compromised.
In this situation, when one service is ...
- 3,869
4
votes
What is the most secured SMTP authentication type?
Apart from best recommendations for SMTP, here is your available list:
LOGIN, PLAIN: Password is transferred in clear-text.
CRAM-MD5: Weak against chosen plaintext and has password storage issues.
...
- 323
4
votes
SMTP Email Spoofing
From your point of view, the situation is even worse. MAIL FROM: and RCPT TO: are only used for the enveloppe addresses, that is the address of the actual sender and the address of the recipients. ...
- 26.9k
4
votes
Accepted
Is Open Port 25 on Web Server dangerous?
I think sometimes people are confused with the word open (in a similar context), maybe imagining like having an open door in the house. Or maybe thinking that if something is open, than for hacker it ...
- 10.2k
4
votes
Accepted
How a spoofing email site such as emkei works
The spoofer will try to scan every ports of a smtp server to catch the mx
The MX is detected by doing a DNS lookup and the MTA is then using port 25 on the server(s) returned by this DNS lookup. No ...
- 208k
4
votes
Accepted
What happens if STARTTLS dropped in SMTP?
SMTP with STARTTLS works by first creating a plain connection to the server and then upgrading it to TLS if the server supports it. The server shows support for STARTTLS within the response to the ...
- 208k
4
votes
Why did PHP 5.6 change how it handles SSL certificates?
With PHP 5.6 the default for using TLS was finally changed to verify certificates by default and verify them properly (i.e. not only certificate chain but also hostname). About the same time similar ...
- 208k
4
votes
Accepted
SSL/TLS compression attacks on mail servers (smtp)
Compression attacks like CRIME and BREACH work by triggering repeated transmission of almost the same message with only slight modifications, with these modifications controlled by the attacker. By ...
- 208k
4
votes
Close Port 587 - Ramifications?
TL;DR: If your users are using 587 to submit email for relay, you need to secure it (by requiring STARTTLS before AUTH) or disable it in favor of an alternative like 465 (SMTPS). If none of your ...
- 73.3k
4
votes
Accepted
Weird character sequence in email subject
This is called quoted-printable formatting and it is required in email because RFC 5322 (.eml, originally RFC 822) explicitly allows only ASCII characters, so RFC 2047 presents an "ASCII-armor&...
- 12.1k
4
votes
Can someone read my email if they have my smtp credentials?
Maybe.
It depends on what controls there are. Credentials alone will not work if:
processes limit which IPs can connect
processes look for anomalies in what is connecting
Multi-factor authentication
...
- 132k
4
votes
Sending Mail from Different Server SPF Record
Setting up a SPF record that permits a third party, over which we have
no control, can send as ‘us’ is the antithesis of Cyber Security.
This opinion is not held by the general cybersecurity ...
- 132k
4
votes
Sending Mail from Different Server SPF Record
One solution to your issue is to send your mail through your main mail host (the one that is listed in your SPF record) instead of using the local SMTP relay on your server.
You will have to get ...
- 18.7k
3
votes
System nmap shows port closed but online nmap tool shows port open
What does closed state means:
A closed port is accessible (it receives and responds to Nmap probe
packets), but there is no application listening on it. They can be
helpful in showing that a ...
- 10.2k
3
votes
Accepted
How to spoof a MIME-level email address
You can for example use telnet and speak the SMTP protocol:
> shell-prompt$ telnet some.mail.server 25
< 220 some.mail.server welcome
> helo its.me
< 250 ...
> mail from: sender@to....
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible