Ask / Submit
2

How is StartTLS integrated? [answered]

asked 2014-06-04 16:46:29 +0300

mgbler gravatar image

When creating an email account, one can choose from 3 options: no encryption ;), SSL and TLS. Where is StartTLS? Is it used by default or does it depend on the port i use? How can I assure that encryption is enforced?

edit retag flag offensive reopen delete

The question has been closed for the following reason "the question is answered, an answer was accepted" by mgbler
close date 2014-06-05 01:17:36.297222

Comments

1

I always assumed the TLS option was StartTLS, and the SSL option was SSL/TLS. I may be wrong.

nthn ( 2014-06-04 18:50:20 +0300 )edit

Hmm yeah i found a comment on TMO (http://talk.maemo.org/showthread.php?t=90037&p=1342121) stating this, but no documentation. If TLS includes StartTLS and SSL includes also TLS this is misleading. StartTLS can be misused to degrade the connection and thus undermine encryption efforts (as o2 Telefonicá did in Germany: http://www.heise.de/security/meldung/Eingriff-in-E-Mail-Verschluesselung-durch-Mobilfunknetz-von-O2-206233.html). That' why i just want to know how i can enforce SSL/TLS and block the use of StartTLS.

mgbler ( 2014-06-04 19:33:08 +0300 )edit

2 Answers

Sort by » oldest newest most voted
3

answered 2014-06-04 20:29:59 +0300

tigeli gravatar image

@nthn is right, TLS is startTLS and SSL is SSL/TLS. I will ask from our developers about dropping the connection if startTLS is filtered out by the server end.

edit flag offensive delete publish link more

Comments

Thx a lot for making this clear!

mgbler ( 2014-06-05 01:08:51 +0300 )edit
3

answered 2014-06-04 21:58:53 +0300

VDVsx gravatar image

@nthn - If the server advertises StartTLS, a encrypted connection is done after the capabilities are listed, if that connection is downgraded in server side it will be dropped in the client side, but if you try to connect to a server not supporting StartTLS while this option is select, it will continue using a plain socket, see code below:

https://qt.gitorious.org/qt-labs/messagingframework/source/aba3f25cf2e8610fa59c103da3891dd62356d392:src/plugins/messageservices/imap/imapauthenticator.cpp#L57

If you want to make sure that encryption is in place, you must select SSL, naming is a bit confusing atm, is like tigeli says above, next update will fix the naming :)

edit flag offensive delete publish link more

Comments

Thank you for going into detail and linking the source. A better naming is much appreciated :) ...btw. perhaps it would be nice to have the qwarning (continuing unencrypted) visible as a notification

mgbler ( 2014-06-05 01:16:54 +0300 )edit

Thanks for the explanation!

nthn ( 2014-06-05 01:24:38 +0300 )edit

Question tools

Follow
2 followers

Stats

Asked: 2014-06-04 16:46:29 +0300

Seen: 264 times

Last updated: Jun 04 '14