STARTTLS Everywhere
starttls-everywhere.org
STARTTLS Everywhere
1–10 of 106 posts
Re: STARTTLS Everywhere
#2Except it’s not like let’s encrypt at all. This appears to test your mail server for starttls functionality, but it doesn’t issue certs or anything like that.
Re: STARTTLS Everywhere
#3Except it’s not like let’s encrypt at all. This appears to test your mail server for starttls functionality, but it doesn’t issue certs or anything like that.
I think the title of the submission is mis-editorialized. The comparison that my colleagues working on this project make is that it's like HTTPS Everywhere, or even more like the HSTS preload list, rather than like Let's Encrypt. I don't think you'll find the comparison to Let's Encrypt on the site itself.
(Edit: in addition to the site tester that you noticed, there is also a public policy list and some forthcoming tools to enforce STARTTLS on the client MTA side when delivering e-mail, preventing downgrade and MITM attacks.)
However, you can also use Let's Encrypt to make this more useful by getting a publicly-trusted certificate for the TLS service on your mail server, and then listing your mail server with this list!
The introductions my colleagues posted about this today are at
https://www.eff.org/deeplinks/2018/06/announcing-starttls-ev...
https://www.eff.org/deeplinks/2018/06/technical-deep-dive-st...
which will hopefully give a clearer explanation of what the service is meant for.
Re: STARTTLS Everywhere
#4Per the comment by djrogers, I think the submission title is mis-editorialized and doesn't describe what this project is meant for very clearly.
Re: STARTTLS Everywhere
#5Yeah, my mail server cert is issued by LetsEncrypt. So this has nothing to do with actually encrypting your SMTP.
Re: STARTTLS Everywhere
#6"STARTTLS Everywhere: HTTPS Everywhere, but for SMTP"
Re: STARTTLS Everywhere
#7[deleted]
Re: STARTTLS Everywhere
#8From my understanding, this is pretty much the same thing as the HSTS preload list[1], except for SMTP servers instead of HTTPS servers. It has two main goals. First, encourage cert validations. If you don't validate a cert, it means nothing. Second, help prevent MITM downgrade attacks. If your server is on the list, it means it should always use a secure cert. If it isnt, then don't connect. Same thing as HSTS preload list.
Re: STARTTLS Everywhere
#9SRTTLS is vulnerable to downgrade attacks. It's better than nothing, but if someone wants to intercept it they can.
Re: STARTTLS Everywhere
#10"STARTTLS Everywhere: HTTPS Everywhere, but for SMTP"
Thanks for the suggestion - Done :-)