It would be better to have a TLS connection right at the start. STARTTLS is less secure. Why hasn't this happened for SMTP?
Email encryption is here – use STARTTLS everywhere
21–30 of 74 posts
Re: Email encryption is here – use STARTTLS everywhere
#22Earlier quoted context omitted.
That's FUD. If a system is correctly set up, you'll have no deliverability issues. Edit: srsly guys, HACKER news people say that it's impossible for a person to have a proper mailserver set up? That's hilarious, if not sad!
This is just not true. The Internet is full of stories of people having trouble with large email providers (notably Google and Microsoft) accepting self-hosted users' mail. A self-hosted setup's IP starts with 0 reputation (or worse, depending on who owned the IP address beforehand) and will face throttling and outright blocking for a painful amount of time. Furthermore, if you forward your email to e.g. a Gmail inbo…
Point 1: spf, dkim, dmarc is enough to get yourself neutral with gmail. You have to do it from get-go tho, before you tarnish your reputation. Being in DNSBL lists does not help either. Set up proper reverse dns entries also. Tls is completely optional. Haven't had any trouble neither with gmail nor ms using both residential and datacenter ips in two EU countries. I don't consider myself a hardcore linux admin specialising in mail, so there's that. As far as the second point, about forwarding spam goes, you're running a mailserver without spamassasin? What is this, the 1990s?
Re: Email encryption is here – use STARTTLS everywhere
#23Earlier quoted context omitted.
That's FUD. If a system is correctly set up, you'll have no deliverability issues. Edit: srsly guys, HACKER news people say that it's impossible for a person to have a proper mailserver set up? That's hilarious, if not sad!
Maybe if you live in a country who's IPs are deemed "trustworthy"
[deleted]
Re: Email encryption is here – use STARTTLS everywhere
#24Earlier quoted context omitted.
I am my own provider. It's really not that hard to configure a mail server. Other peoples' providers, however... so I tried using PGP. It's somehow manages to be more difficult to use than configuring and running your own mailsystem which doesn't deliver straight to gmails' spam folder, but I digress; but then my emails are at mercy of the end devices: who knows if outlook doesn't send a plaintext email home as "tele…
Also all of your emails get kicked to spam when you host your own.
You can perfectly "host your own email server" while sending outgoing mail through a smart host. No falsely-tagged-spam issue that way.
Re: Email encryption is here – use STARTTLS everywhere
#25Sure, STARTTLS is better than nothing, but your email provider still reads your email. When we talk about email encryption, we mean end-to-end encryption.
So you are saying you do not trust your e-mail provider to secure your email. At that point I suggest finding another provider or running your own service. This secures a significant point of interception and modification of data.
[deleted]
Re: Email encryption is here – use STARTTLS everywhere
#26Re: Email encryption is here – use STARTTLS everywhere
#27Earlier quoted context omitted.
That's FUD. If a system is correctly set up, you'll have no deliverability issues. Edit: srsly guys, HACKER news people say that it's impossible for a person to have a proper mailserver set up? That's hilarious, if not sad!
This is just not true. The Internet is full of stories of people having trouble with large email providers (notably Google and Microsoft) accepting self-hosted users' mail. A self-hosted setup's IP starts with 0 reputation (or worse, depending on who owned the IP address beforehand) and will face throttling and outright blocking for a painful amount of time. Furthermore, if you forward your email to e.g. a Gmail inbo…
I'm trying to figure out how big those problems actually are. I can't say anything about the stories people tell, but I have no trouble sending to gmail nor anybody else.
Re: Email encryption is here – use STARTTLS everywhere
#28Earlier quoted context omitted.
That's FUD. If a system is correctly set up, you'll have no deliverability issues. Edit: srsly guys, HACKER news people say that it's impossible for a person to have a proper mailserver set up? That's hilarious, if not sad!
Keeping your own server up at several nines of uptime is a non-trivial endeavour.
The great thing about SMTP is that it retries automatically, so "several nines" can take a backseat.
Re: Email encryption is here – use STARTTLS everywhere
#29The site has a link to the starttls everywhere site right at the top - but it's also worth mentioning that the regular 'certbot' client for https everywhere can also be used to create certificates for your own smtpd. The easiest way is just having the sudo ability to temporarily open port 80 for the challenge/response process. using certbot: sudo ./certbot-auto certonly -v --standalone --standalone-supported-challeng…
Thanks for the plug. The same developer at EFF is working on both STARTTLS Everywhere and Certbot Postfix integration. :-) (Anyway, the most significant difference between the two is that STARTTLS Everywhere can also enforce certificate validation on recipient sites that request it, which Postfix won't otherwise do.)
Thanks for calling that part out!
Re: Email encryption is here – use STARTTLS everywhere
#30[deleted]