Jeff Atwood's security blunder regarding email

Re:Jeff Atwood's security blunder regarding email by zwp on Monday April 30, 2012 @05:27AM (#3908573)

> GMail does not require STARTTLS.

    $ telnet smtp.gmail.com 587
    Trying 173.194.67.108...
    Connected to gmail-smtp-msa.l.google.com.
    Escape character is '^]'.
    220 mx.google.com ESMTP ea6sm27303065wib.5
    HELO zwp
    250 mx.google.com at your service
    AUTH PLAIN [elided]
    530 5.7.0 Must issue a STARTTLS command first. ea6sm27303065wib.5



    $ telnet smtp.gmail.com 587 
    Trying 173.194.67.109...
    Connected to gmail-smtp-msa.l.google.com.
    Escape character is '^]'.
    220 mx.google.com ESMTP ff2sm43397967wib.9
    HELO zwp
    250 mx.google.com at your service
    MAIL FROM:<[email protected]>
    530 5.7.0 Must issue a STARTTLS command first. ff2sm43397967wib.9

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by techsupporter on Monday April 30, 2012 @07:13AM (#3908738)

Please try your test again on port 25, which is the port that server-to-server e-mail would use, as the post above yours said that it is possible to send e-mail to @gmail.com without using STARTTLS. This is, in fact, not only possible but required. Otherwise, @gmail.com would be inaccessible to any e-mail address using an MTA that does not support or is not configured for TLS.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by quonn on Monday April 30, 2012 @06:00AM (#3908626)

This is outgoing SMTP. It does not require it for _incoming_ SMTP.

[ Parent | on HN ]

Re:Jeff Atwood's security blunder regarding email by tantalor on Monday April 30, 2012 @12:44PM (#3910008)

Gmail recommends (or requires) SSL for both IMAP[1] and POP[2].

[1] http://support.google.com/mail/bin/answer.py?hl=en&answe... [2] https://support.google.com/mail/bin/answer.py?hl=en&answ...

[ Parent | on HN ]