News for hackers. Stuff that matters.

A comment on An Ode to Apple’s Hide My Email. Parent comment

Re:An Ode to Apple’s Hide My Email by gruez on Monday April 11, 2022 @11:17AM (#30990004)
>but anyone with the access to the wire could MITM the connections. Maaaaybe something changed in the last ten years

The section on MTA-STS describes how that attack is mitigated.

[ Parent | on HN ]
Re:An Ode to Apple’s Hide My Email by justsomehnguy on Tuesday April 12, 2022 @05:11AM (#31000270)
> mitigated

For this attack to be mitigated everyone should implement it. Gmail and Live.com has MTA-STS records, Fastmail doesn't, one regional provider with millions of accounts doesn't have it too.

And finally your MTA should support it and be configured to deny the delivery if MTA-STS validation fails (and adversary, who is happily MITMing your traffic, shouldn't fiddle with DNS and HTTPS and of course blocking HTTP/S from the MX would be considered cheating!).

All in all, SMTP traffic is encrypted, but it is not secured.

[ Parent | on HN ]