Collaborate Disseminate
What attacks should I consider:
When sanitizing the user’s input (their email address), for example to prevent local deliveries?
To prevent any sort of Denial of Service against the mail sending service?
When sending mail o… Continue reading What security considerations are there when sending an email from my software to a user? [on hold]
We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant solution for it.
Has any… Continue reading SMTP Service STARTTLS Plaintext Command Injection
I’m facing an issue to sync Ambari with a LDAP server using StartTLS and a self-signed certificate. Ambari server and ldap server are both running on the same machine. I’ve followed the steps written in the doc but I’m not su… Continue reading Ambari sync with LDAP using StartTLS [migrated]
I am currently writing an essay about securing e-mail. Now I’m at the point where I want to know if it’s possible to force TLS in connections via SMTP or POP3/IMAP from the clients’ side. I know I can configure the client so it uses STARTT… Continue reading How to Force STARTTLS on Outlook and other clients
Warning that the U.S. Supreme Court’s emails “remain needlessly exposed to surveillance and potentially compromised by third parties,” Sen. Ron Wyden urged change Monday within the judicial branch and continued his office’s public campaign to bolster information security within the federal government. Wyden, D-Ore,, published a letter to the U.S. Supreme Court urging their director of information technology to adopt STARTTLS encryption “to better protect the privacy and security of the Court’s email communications.” Pointing to wide adoption of STARTTLS in private industry and across government, Wyden pushed the Supreme Court to use the technology because without it “email messages sent to and from the Supreme Court remain needlessly exposed to surveillance and potentially compromised by third parties.” The letter echoes another sent by Wyden earlier this year urging the Defense Information Systems Agency to implement STARTTLS in their email systems. “Major technology companies like Google, Yahoo, Microsoft, Facebook, Twitter, and Apple […]
The post Wyden pushes Supreme Court to adopt email encryption standards that it currently doesn’t use appeared first on Cyberscoop.
SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I’m not entirely clear on the reasoning behind that, but it was clearly considered a good idea at the time.
SMTP uses STARTTLS extension to upgrade SMTP to SMTP Secure (STMPS). According the the RFC, the client and server starts TLS as follows:
S: <waits for connection on TCP port 25>
C: <opens connection>
S: 220… Continue reading What happens if STARTTLS dropped in SMTP?
Basic decade-old encryption technology is finally coming to Pentagon email servers next year. Continue reading The Pentagon Says It Will Start Encrypting Soldiers’ Emails Next Year
STARTTLS, which is used to secure the email handled by many organizations, isn’t perfect, but it can be useful Continue reading Why isn’t US military email protected by standard encryption tech?
Opportunistic TLS refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate port for encrypted comm… Continue reading What is the purpose of opportunistic TLS (like STARTTLS)?