Re:The sad state of SMTP encryption
by thrownaway2424 on Wednesday November 11, 2015 @07:53AM
(#10546396)
For organizations that subscribe to these cloud services (like Google Apps, or hosted Exchange) there are settings to enforce the use of TLS on both inbound and outbound. For example https://support.google.com/a/answer/2520500
Re:The sad state of SMTP encryption
by capt_hotpants on Monday November 23, 2015 @06:45PM
(#10618171)
If you read the fine print in bullet #8, you'll discover that there is, per default, no validation of the presented certificate at all.
Without proper certificate validation, the encryption step is cryptographically worthless. Anyone can MITM the traffic just by presenting a random certificate to the sender.
For me personally, I'm not too worried about the NSA. But I do think it is quite silly that Gmail and Outlook has a little lock icon to indicate that security is ON, while the first thing that happens when you click Send is that your email is whizzed over half the internet in plaintext.
For organizations and corporations, I imagine they would very much like to be able to verify the identity of the receiving organization before delivering possibly sensitive email.
(The sender identity is already authenticated via DKIM.)