free
/
freedombone
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

quote

This commit is contained in:
Bob Mottram 2015-10-28 22:51:38 +00:00
parent da8b51ce52
commit e9d8f4aba9
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
website/EN/usage.html
View File

@ -4,7 +4,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head> <head>
<title></title> <title></title>
<!-- 2015-10-06 Tue 20:21 --> <!-- 2015-10-28 Wed 22:51 -->
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" /> <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<meta name="generator" content="Org-mode" /> <meta name="generator" content="Org-mode" />
<meta name="author" content="Bob Mottram" /> <meta name="author" content="Bob Mottram" />
@ -287,6 +287,16 @@ If you wish to only use ssh keys then log in to the Freedombone and edit <b>/etc
<p> <p>
Port 465 is used for SMTP and this is supposedly deprecated for secure email. However, using TLS from the start of the communications seems far more secure than starting off with insecure communications and then trying to upgrade it with a command to begin TLS, as happens with STARTTLS. There are <a href="https://www.eff.org/deeplinks/2014/11/starttls-downgrade-attacks">possible attacks against STARTTLS</a> in which the command to begin secure communications is removed or overwritten which could then result in email being transferred in plain text over the internet and be readable by third parties. Port 465 is used for SMTP and this is supposedly deprecated for secure email. However, using TLS from the start of the communications seems far more secure than starting off with insecure communications and then trying to upgrade it with a command to begin TLS, as happens with STARTTLS. There are <a href="https://www.eff.org/deeplinks/2014/11/starttls-downgrade-attacks">possible attacks against STARTTLS</a> in which the command to begin secure communications is removed or overwritten which could then result in email being transferred in plain text over the internet and be readable by third parties.
</p> </p>
<p>
From <a href="http://motherboard.vice.com/read/email-encryption-is-broken">http://motherboard.vice.com/read/email-encryption-is-broken</a>:
</p>
<blockquote>
<p>
The researchers also uncovered mass scale attacks of STARTTLS sessions being stripped of their encryption. That attack itself isn't new: internet service providers sometimes do it to monitor users; organizations may use it to keep an eye on employees; or it may come from a malicious actor
</p>
</blockquote>
</div> </div>
</div> </div>
<div id="outline-container-orgheadline11" class="outline-3"> <div id="outline-container-orgheadline11" class="outline-3">