News for hackers. Stuff that matters.

A comment on Jeff Atwood's security blunder regarding email. Parent comment

Re:Jeff Atwood's security blunder regarding email by biafra on Monday April 30, 2012 @02:28AM (#3908258)
GMail does not require STARTTLS.

I am sure you can send email to GMail accounts with unencrypted SMTP. Just look at the incoming "Received" headers. If they do not contain a "cipher=" section, the connection was not encrypted.

I think what you mean is that GMail requires you to use https for their web interface.

[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by mct on Monday April 30, 2012 @03:45AM (#3908381)
I think what you mean is that GMail requires you to use https for their web interface.

gmail requires STARTTLS (or ssmtp) when an authenticated user submits outbound mail to them via SMTP (http://support.google.com/mail/bin/answer.py?hl=en&answe...), which is what he may have been mis-remembering. But, yes, it is incorrect that all mail sent to gmail.com addresses is TLS encrypted.

[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by bigiain on Monday April 30, 2012 @05:02AM (#3908529)
I feel kinda dirty sticking up for Jeff here - but that means if you _know_ your outbound mail always uses TLS when available, then maybe the security-in-transit concerns are eliminated. (I don't even know where I'd start trying to find out if all my possible ways of sending myself mail can be conclusively determined to be using TLS though.)
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by garethadams on Monday April 30, 2012 @08:51AM (#3908986)
That would be a perfect counter argument, except the point mentioned in the article specifically related to getting passwords sent to you from other services.
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by zwp on Monday April 30, 2012 @05:27AM (#3908573)
> GMail does not require STARTTLS.

    $ telnet smtp.gmail.com 587
    Trying 173.194.67.108...
    Connected to gmail-smtp-msa.l.google.com.
    Escape character is '^]'.
    220 mx.google.com ESMTP ea6sm27303065wib.5
    HELO zwp
    250 mx.google.com at your service
    AUTH PLAIN [elided]
    530 5.7.0 Must issue a STARTTLS command first. ea6sm27303065wib.5



    $ telnet smtp.gmail.com 587 
    Trying 173.194.67.109...
    Connected to gmail-smtp-msa.l.google.com.
    Escape character is '^]'.
    220 mx.google.com ESMTP ff2sm43397967wib.9
    HELO zwp
    250 mx.google.com at your service
    MAIL FROM:<[email protected]>
    530 5.7.0 Must issue a STARTTLS command first. ff2sm43397967wib.9
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by techsupporter on Monday April 30, 2012 @07:13AM (#3908738)
Please try your test again on port 25, which is the port that server-to-server e-mail would use, as the post above yours said that it is possible to send e-mail to @gmail.com without using STARTTLS. This is, in fact, not only possible but required. Otherwise, @gmail.com would be inaccessible to any e-mail address using an MTA that does not support or is not configured for TLS.
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by quonn on Monday April 30, 2012 @06:00AM (#3908626)
This is outgoing SMTP. It does not require it for _incoming_ SMTP.
[ Parent | on HN ]
Re:Jeff Atwood's security blunder regarding email by tantalor on Monday April 30, 2012 @12:44PM (#3910008)
Gmail recommends (or requires) SSL for both IMAP[1] and POP[2].

[1] http://support.google.com/mail/bin/answer.py?hl=en&answe... [2] https://support.google.com/mail/bin/answer.py?hl=en&answ...

[ Parent | on HN ]