Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the Thunderbird 3 SMTP configuration dialog, there's a security section:

Thunderbird sending mail dialog

If I want to send email without naughty hackers intercepting it, what should I choose? The "Connection security" options are "None", "STARTTLS" and "SSL/TLS" - which is best?

Do I need an authentication method, or is that just for the mail server to know who I am? (if so I don't care about this, since I can already send email without problems.)

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

First you need to know if your mail server is capable of or even allows you to send mail through SSL (Secure Sockets Layer) or TLS (Transport Layer Security) modes.

Basically the options break down to this:

  • None
    No encryption on the outgoing emails. They will be sent as plain as day between you and the server.

  • STARTTLS (formerly TLS in Thunderbird 2)
    The mail client will ask the server if it's possible to send through using TLS and if so, use the secure method. If not, silently fail and send through as a normal plain connection.

  • SSL/TLS (SSL in Thunderbird 2)
    Similar to above, but it assumes you can already send through using the secure mode and attempts to do so. If you're not allowed, it will fail and not send. This is the most secure method.

If you're told to use port 465 for outgoing and 995 for incoming then you're likely able to send through SSL.

share|improve this answer
    
Does the security here apply to everything, including actually sending the email? So as long as I have it set to SSL/TLS, I can be sure that my email is being sent securely? –  Colen May 4 '11 at 20:01
    
This is for the link between your machine and the server. After that, who knows. But look in to PGP as mentioned in smintz's answer. @col –  random May 4 '11 at 20:18
add comment

Its depends on your server's configuration. You cannot just decide to use encryption if your server doesn't support it.

However, this is only about the authentication, and the communication between you and your mail server, the message will be transmitted as plain from your mail server to the next one. so this only concern about preventing someone to steal your password with a "Man in the middle" attack.

If you are concern about the the context of your message to be secured. you will have to encrypt the context of the message. I recommend to use the enigmail plugin (gpg implementation for thunderbird), be aware that the recipient should provide you his public key.

share|improve this answer
1  
+1 for Enigmail. I was in the middle of writing my own recommendation when this one popped in. Links: enigmail.mozdev.org for the Enigmail plugin, and gnupg.org for the GnuPG back-end. –  Iszi May 4 '11 at 17:56
add comment

It all really comes down to what your e-mail provider offers. Some offer encryption out the ears, others practically enforce using Telnet over a 300 baud dial up modem.

Obviously, encryption is a Good Thing. In theory, STARTTLS is worse than SSL/TLS since "STARTTLS" essentially means "use TLS if available" but keeps going if it's not whereas "SSL/TLS" means "use SSL no exceptions."

If your connection is encrypted then you don't need to worry too much about choosing between "Normal Password" and "Encrypted Password." If you test it and find that things don't work anymore with "Encrypted Password" then go back to Normal.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.