Re: email authentication
From: T. Sean Weintz (strap_at_hanh-ct.org)
Date: 10/26/04
- Previous message: Security Alert: "SSRT3526 rev.0 Serviceguard potential increase in privilege"
- In reply to: willy gates: "email authentication"
- Next in thread: Srfig: "Re: email authentication"
- Reply: Srfig: "Re: email authentication"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 26 Oct 2004 10:44:18 -0400
willy gates wrote:
> Hello
>
> BT have asked us to enable SMTP email authentication, good idea I
> thought...
>
> But then I began to think...
>
> I am logging into BT SMTP or POP3 server and sending them a login and
> a password. I have not got a secure connection SSL, nor is secure
> authentication supported. Therefore I assume that I am sending a
> plaintext username and password each time I log into the BT server to
> send/receive my email.
>
> Is this correct?
Yes. The password for both smtp and pop3 goes over the wire plaintext.
Given that you likely already log in for pop3 anyway, doing the same
thing for SMTP would not be a much bigger security hole.
>
> That means if I get a virus that wants to set up a spam zombie on my
> machine sending spam to my BT server then BT have prevented them from
> sending unauthenticated spam however it wouldn't take much to read my
> unauthenticated password
No, but so far no-one has thought of this. See why below-
> and start using my BT login to send spam. Or
> do the spam zombies created by these virus send their email using
> other servers?
The spam zombies generally have their own server built in. Esp. the self
replicating ones. The spew goes straight from the users machine to the
targets smtp server, bypassing the local ISP server.
That is why many consumer oriented ISP's are blocking port 25 to
anything other than their own mail servers.
T. Sean Weintz
- Previous message: Security Alert: "SSRT3526 rev.0 Serviceguard potential increase in privilege"
- In reply to: willy gates: "email authentication"
- Next in thread: Srfig: "Re: email authentication"
- Reply: Srfig: "Re: email authentication"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
