[liberationtech] The status of SMTP security in email communication infrastructures

[staticsafe]

On Mon, Aug 26, 2013 at 01:02:26PM +0200, Moritz Bartl wrote:
> >   - which of them offer SMTP/TLS when sending email?
> >   - which of them accept SMTP/TLS when receiving email?
> 
> Received: from smtp.stanford.edu (smtp1.Stanford.EDU [171.67.219.81])
> 	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
> 	(No client certificate requested)
> 	by mail.headstrong.de (Postfix) with ESMTPS id 5107C1C0013B
> 
> Does anyone have contacts at Gmail, Fastmail, or any other large mail
> provider that would be interested in conducting a study? At least
> Postfix logs TLS information to mail.log by default, and can be
> configured to add the above TLS information to mail headers.
> -- 
> Moritz Bartl
> https://www.torservers.net/
> -- 

A note about that Postfix feature:
smtpd_tls_received_header (default: no)

    Request that the Postfix SMTP server produces Received: message
    headers that include information about the protocol and cipher used,
    as well as the remote SMTP client CommonName and client certificate
    issuer CommonName. This is disabled by default, as the information
    may be modified in transit through other mail servers. Only
    information that was recorded by the final destination can be
    trusted. 
-- 
staticsafe
O< ascii ribbon campaign - stop html mail - www.asciiribbon.org
Please don't top post.
Please don't CC! I'm subscribed to whatever list I just posted on.