On Wed, May 05, 2010 at 03:30:06PM +0100, Kevin Chadwick wrote:
quoted text
> Do you not think it would be better for mail servers to try ssl on one
> port and then plain on port 25 if a rst or timeout occurs. Then it
> would be harder for attackers to force falling back to plain and
> forcing only tls would be easier.
 
Ugh...
If the attacker can modify the EHLO to not include STARTTLS he surely
can also send a RST in response to your attempt to connect to another
port.

Also, SSL is completely useless without DNSSEC. You just need to spoof
the MX records or the A records they point to and you've lost.

Current day email just is not secure. It's no use trying to pretend
otherwise.

Jussi Peltola