Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4682

Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird)

Show all headers | View raw

On Mon, Apr 11, 2016 at 1:10 AM, Elmar Stellnberger <estellnb@gmail.com> wrote:
> I still had the STARTTLS setting activated for my revido account and changed
> it to SSL/TLS as soon as I had heard how dangerous that might be.
> Unfortunately there are no geographical warnings for login attempts from the
> revido account (Accordings to ¿German law? they do not even expose me their
> server log cotaining the IPs with login attempts which could be backtraced
> with geoip). I`d personally believe that unsuspecting users should be warned
> of the fallback option of STARTTLS as it sounds like TLS but it can start an
> unencrypted connection as well.

Implemented properly it shouldn't matter which option you pick. The
SSL/TLS option is actually depreciated. Thunderbird should refuse a
connection if you have STARTTLS checked and the server doesn't support
it. It sounds more like your login was what was throwing the alert.
The best advice I can offer is to not use an "untrusted" VPN. Free VPN
services have to make money somehow.

Brandon Vincent

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-10 18:30 +0200
  Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-11 00:10 +0200
    Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 08:30 +0200
  Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Evgeny Kapun <abacabadabacaba@gmail.com> - 2016-04-11 09:00 +0200
    Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 10:20 +0200
      Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-04-11 11:30 +0200
        Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 19:30 +0200
          Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Vaughn Graham <vaughng@dmsllconline.net> - 2016-04-11 21:00 +0200
            Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 21:20 +0200
            Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-12 05:20 +0200
      Re: SSL/TLS still seems to be screwed up (retrieving Mail with Thunderbird) Brandon Vincent <Brandon.Vincent@asu.edu> - 2016-04-11 15:00 +0200
        Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 21:50 +0200
          Re: SSL/TLS still seems to be screwed up (retrieving Mail with  Thunderbird) Elmar Stellnberger <estellnb@gmail.com> - 2016-04-11 22:50 +0200

csiph-web