Article

How to Misuse SMTP over TLS: A Study of the (In) Security of Email Server Communication

Authors:

Lars Baumgäertner,

Jonas Höchst,

Matthias Leinweber,

Bernd FreislebenAuthors Info & Claims

TRUSTCOM '15: Proceedings of the 2015 IEEE Trustcom/BigDataSE/ISPA - Volume 01

Pages 287 - 294

https://doi.org/10.1109/Trustcom.2015.386

Published: 20 August 2015 Publication History

Abstract

Electronic mail is one of the oldest and widely used services in the Internet. In this paper, an empirical study of the security properties of email server communication within the German IP address space range is presented. Instead of investigating end-user security or end-to-end encryption, we focus on the connections between SMTP servers relying on transport layer security. We analyze the involved ciphers suites, the certificates used and certificate authorities, and the behavior of email providers when communicating with improperly secured email servers. Conclusions drawn from this analysis lead to several recommendations to mitigate the security issues currently present in the email system as it is deployed in the Internet.

Index Terms

How to Misuse SMTP over TLS: A Study of the (In) Security of Email Server Communication
1. Information systems
  1. World Wide Web
    1. Web applications
      1. Internet communications tools
        Email
2. Security and privacy

Index terms have been assigned to the content through auto-classification.

Recommendations

How to Misuse SMTP over TLS: A Study of the (In) Security of Email Server Communication
TRUSTCOM '15: Proceedings of the 2015 IEEE Trustcom/BigDataSE/ISPA - Volume 01

Electronic mail is one of the oldest and widely used services in the Internet. In this paper, an empirical study of the security properties of email server communication within the German IP address space range is presented. Instead of investigating end-...
Security by Any Other Name: On the Effectiveness of Provider Based Email Security
CCS '15: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

Email as we use it today makes no guarantees about message integrity, authenticity, or confidentiality. Users must explicitly encrypt and sign message contents using tools like PGP if they wish to protect themselves against message tampering, forgery, ...
Multi-Context TLS (mcTLS): Enabling Secure In-Network Functionality in TLS
SIGCOMM'15

A significant fraction of Internet traffic is now encrypted and HTTPS will likely be the default in HTTP/2. However, Transport Layer Security (TLS), the standard protocol for encryption in the Internet, assumes that all functionality resides at the ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

TRUSTCOM '15: Proceedings of the 2015 IEEE Trustcom/BigDataSE/ISPA - Volume 01

August 2015

2844 pages

ISBN:9781467379526

Publisher

IEEE Computer Society

United States

Publication History

Published: 20 August 2015

Author Tags

Qualifiers

Article

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

0
Total Citations
0
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 26 Sep 2024

Other Metrics

View Author Metrics

Citations

View Options

View options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Abstract

Index Terms

Recommendations