Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Following up this question on serverfault "Is STARTTLS more safe than TLS/SSL?" it came up that the question is rather a question about Thunderbird and not about the actual protocols. Also, if you Google about this topic you will find many different answers contradicting each other.

Thunderbird (talking about current version 17, but it's like this since version 3) offers three methods of encrypting transfers:

  • None
  • SSL/TLS
  • STARTTLS

And before TB version 3, there were these option

  • None
  • SSL
  • TLS
  • TLS, if available

With TB version 3 the last two where merged and renamed to "STARTTLS" and the "SSL" was renamed to "SSL/TLS" in the config dialog. And now according to this question and answer "Secure email sending with Thunderbird?", Thunderbird could fallback to plaintext transfer when using STARTTLS without noticing me! STARTTLS is also the default configuration of Thunderbird.

The question are:

  1. Can Thunderbird really fall back to plaintext transfer without telling me and establishing the connection anyways (which would be a security risk)?
  2. What version of SSL, TLS and STARTTLS does Thunderbird support?
  3. Is there some indicator in TB telling which encryption method (protocol and version) is actually used?
  4. Is there a way to force TB to use TLS and if not supported by server to not connect at all? (option "SSL/TLS" seems it can't handle TLS (I tried it), and STARTTLS which could do TLS may have the "silent fall back" security risk)
share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

1) That's possible. According to the specification:

2.3. Clear-Text Password Requirements

Clients and servers which implement STARTTLS MUST be configurable to refuse all clear-text login commands or mechanisms (including both standards-track and nonstandard mechanisms) unless an encryption layer of adequate strength is active.

thus, there MUST be a checkbox which would specifically restrict plain-text login. But there isn't. I expect that this is a default behaviour in Thunderbird, but I don't know for sure, so we can expect that.

2) I guess it support all major versions used. SSL is obsolete and slowly being replaced by TLS. However contradictory to it's name STARTTLS can use SSL as encription protocol, all depends on the protocols that server supports.

3) I don't know about such possibility.

4) I guess 1) answers that too (i.e. you can't force it, but most probably that's default behaviour). Note: "SSL/TLS" and "STARTTLS" isn't interoperable protocols (that's why they use different ports).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.