Following up this question on serverfault "Is STARTTLS more safe than TLS/SSL?" it came up that the question is rather a question about Thunderbird and not about the actual protocols. Also, if you Google about this topic you will find many different answers contradicting each other.
Thunderbird (talking about current version 17, but it's like this since version 3) offers three methods of encrypting transfers:
And before TB version 3, there were these option
- TLS, if available
With TB version 3 the last two where merged and renamed to "STARTTLS" and the "SSL" was renamed to "SSL/TLS" in the config dialog. And now according to this question and answer "Secure email sending with Thunderbird?", Thunderbird could fallback to plaintext transfer when using STARTTLS without noticing me! STARTTLS is also the default configuration of Thunderbird.
The question are:
- Can Thunderbird really fall back to plaintext transfer without telling me and establishing the connection anyways (which would be a security risk)?
- What version of SSL, TLS and STARTTLS does Thunderbird support?
- Is there some indicator in TB telling which encryption method (protocol and version) is actually used?
- Is there a way to force TB to use TLS and if not supported by server to not connect at all? (option "SSL/TLS" seems it can't handle TLS (I tried it), and STARTTLS which could do TLS may have the "silent fall back" security risk)