Secure email sending with Thunderbird?

Question

In the Thunderbird 3 SMTP configuration dialog, there's a security section:

If I want to send email without naughty hackers intercepting it, what should I choose? The "Connection security" options are "None", "STARTTLS" and "SSL/TLS" - which is best?

Do I need an authentication method, or is that just for the mail server to know who I am? (if so I don't care about this, since I can already send email without problems.)

Answer 1

First you need to know if your mail server is capable of or even allows you to send mail through SSL (Secure Sockets Layer) or TLS (Transport Layer Security) modes.

Basically the options break down to this:

• None
  No encryption on the outgoing emails. They will be sent as plain as day between you and the server.

• STARTTLS (formerly TLS in Thunderbird 2)
  The mail client will ask the server if it's possible to send through using TLS and if so, use the secure method. If not, silently fail and send through as a normal plain connection.

• SSL/TLS (SSL in Thunderbird 2)
  Similar to above, but it assumes you can already send through using the secure mode and attempts to do so. If you're not allowed, it will fail and not send. This is the most secure method.

If you're told to use port 465 for outgoing and 995 for incoming then you're likely able to send through SSL.

Answer 2

Its depends on your server's configuration. You cannot just decide to use encryption if your server doesn't support it.

However, this is only about the authentication, and the communication between you and your mail server, the message will be transmitted as plain from your mail server to the next one. so this only concern about preventing someone to steal your password with a "Man in the middle" attack.

If you are concern about the the context of your message to be secured. you will have to encrypt the context of the message. I recommend to use the enigmail plugin (gpg implementation for thunderbird), be aware that the recipient should provide you his public key.

Answer 3

It all really comes down to what your e-mail provider offers. Some offer encryption out the ears, others practically enforce using Telnet over a 300 baud dial up modem.

Obviously, encryption is a Good Thing. In theory, STARTTLS is worse than SSL/TLS since "STARTTLS" essentially means "use TLS if available" but keeps going if it's not whereas "SSL/TLS" means "use SSL no exceptions."

If your connection is encrypted then you don't need to worry too much about choosing between "Normal Password" and "Encrypted Password." If you test it and find that things don't work anymore with "Encrypted Password" then go back to Normal.