Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think you are missing something here / a clarification.

Almost all mail clients (MUAs) I've seen will validate the TLS certificate.

Almost no mail servers (MTAs) will validate the TLS certificate. This is because a) TLS isn't required, so a MITM could just strip the STARTTLS and everything would need to continue to work, and b) It doesn't provide any security.

TLS on the client is really securing the client credentials - not the email. TLS on the server is per hop - not to the final destination, so it doesn't protect a MITM attack.

If you want encrypted email, encrypt the email - don't use per hop encryption.



> Almost no mail servers (MTAs) will validate the TLS certificate.

Right. This is what I was referring to -- sorry, I could have been more clear.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: