Microsoft outlook is a 27-year-old security failure.
Microsoft outlook is a failure.
Microsoft is a failure
Someone who’s still using POP instead of IMAP4 probably hasn’t updated their setup in 20 years.
This is a good reminder to use the secure ports for IMAP (993) and SMTP (465). Don’t use ports that use opportunistic TLS (STARTTLS), which are 143 for IMAP and 587 for SMTP. These start unencrypted and switch to using encryption once the server says it supports it. An attacker can just modify the response and say the server doesn’t support encryption, in which case the connection will remain unencrypted. https://en.wikipedia.org/wiki/Opportunistic_TLS#Weaknesses_and_mitigations
You can force encryption on the client side… but then you may as well just use the port that’s always encrypted.
(yes, I know that the TLS handshake isn’t encrypted either)
Forcing encryption reduced my spam by about 99%. Spambots almost never have certificates.
It also prevented email being delivered from Nintendo, because they can’t tie two network wires together.
In my experience, no large business would decide to only accept encrypted inbound SMTP. So as usual with SMTP you try to handle the worst clients sending you mail with nothing security wise (no DKIM, no SPF, no TLS) and still try to filter all the spam out of it and that’s about it.
And I acknowledge the effort from google to push the security to get better but even then nobody wants to accept to miss a few dirty emails for the sake of security.
The stance is unfortunately to never be the one refusing emails even when they are absolutely and completely unsecured. It really sucked being an admin on that kind of systems. SMTP is one of the worst protocols I have ever seen so widely used and there is still this idea that you should accept mail even when they dont fully respect the basic security requirements Gmail has made mandatory.
Most of the time the higher ups didn’t seem to care about the confidentiality of mails received.
My mail provider optionally supports this. They have a subdomain with an SMTP server that rejects unencrypted connections, I just have to hand out …@secure.mailbox.org instead of …@mailbox.org as my mail address.
In my experience, no large business would decide to only accept encrypted inbound SMTP
For submission (connections coming from users that have an account on the server) or for relay/target (connections coming from other email clients)? All email clients support encryption so I think requiring encryption for submission is reasonable. Server-to-server (port 25) can’t have it enforced though, like you said.
SMTP is one of the worst protocols I have ever seen so widely used
It’s from a era where everyone trusted everyone else. All connections were unencrypted, spam protection and rate limiting weren’t needed, and security really wasn’t on people’s minds. Modern security and spam protection is hacky because it’s built on top of protocols that weren’t designed for it.
The other major issue with old protocols is that they’re stateful. Modern protocols are mostly stateless since it’s generally easier to deal with. They’ve also had more and more features hacked into them over time, so the specs are enormous.
There’s been one major attempt at modernizing it: JMAP. It’s stateless, uses JSON, and intends to replace both IMAP and SMTP. FastMail started the project. https://jmap.io/why-jmap/
However, they’ve only looked at the “easier” part to replace: Communication between a user and their email server. They’re not looking to replace server-to-server communication at all.
That link is geo blocked in Denmark 😔
??? I can access it from Denmark though. Without a VPN.
Maybe because I have Yousee?
Yeah, this is just a TDC/YouSee thing, not a Denmark thing.
You want encrypted communications? Don’t you worry, just let me start netcat and you’re good!
