News for hackers. Stuff that matters.

A comment on The sad state of SMTP encryption. Parent comment

Re:The sad state of SMTP encryption by thrownaway2424 on Wednesday November 11, 2015 @07:53AM (#10546396)
For organizations that subscribe to these cloud services (like Google Apps, or hosted Exchange) there are settings to enforce the use of TLS on both inbound and outbound. For example https://support.google.com/a/answer/2520500
[ Parent | on HN ]
Re:The sad state of SMTP encryption by capt_hotpants on Monday November 23, 2015 @06:45PM (#10618171)
If you read the fine print in bullet #8, you'll discover that there is, per default, no validation of the presented certificate at all.

Without proper certificate validation, the encryption step is cryptographically worthless. Anyone can MITM the traffic just by presenting a random certificate to the sender.

[ Parent | on HN ]