News for hackers. Stuff that matters.

A comment on Someone is stealing unpublished book manuscripts in a phishing scam. Parent comment

Re:Someone is stealing unpublished book manuscripts in a phi... by londons_explore on Saturday December 26, 2020 @11:11AM (#25544257)
It goes encrypted, but hardly anyone checks TLS certificates on SMTP connections. That means you're not safe against any ISP on the route who could simply proxy with a self signed cert...

Thats barely better than unencrypted.

[ Parent | on HN ]
Re:Someone is stealing unpublished book manuscripts in a phi... by raverbashing on Saturday December 26, 2020 @12:17PM (#25544766)
Hardly anyone who? Email clients are supposed to check or they're internally bound (Gmail web client etc).

Yes I think you can bypass the checks but doesn't mean they aren't checked

[ Parent | on HN ]
Re:Someone is stealing unpublished book manuscripts in a phi... by londons_explore on Saturday December 26, 2020 @06:04PM (#25547164)
Server to server connections.

Eg. Gmail.com sending email to cnn.com. That would be TLS encrypted, but the server certificate wouldn't be checked.

[ Parent | on HN ]