On Tue, 27 Apr 2004, Andrey Tverdokhleb wrote:
>
> Well, I'm asking actually because I heard that STARTTLS without EHLO is
> some kind of security threat and would be interested in getting more
> details if this is true.
If instead of checking the server's ESMTP service extension list you just
try STARTTLS and fall back to cleartext SMTP if it fails, you make it
easier to perform a man-in-the-middle security downgrade attack since
STARTTLS is the first thing you say. The attack is still possible if you
follow the protocol correctly but it requires modification of later parts
of the TCP stream. There's more about this in 3207.
--
Tony Finch <dot@???>
http://dotat.at/
