I use Thunderbird to connect to an IMAP and SMTP server. This works on the port numbers usually associated with unencrypted mail, but I have specified STARTTLS and am told that the servers enable encryption. How can I verify that the connections are actually encrypted?
Connecting as TLS to these port numbers doesn't work, and the servers are not listening on the higher ports normally associated with encrypted mail.
I am also tangentially suspicious of STARTTLS and you may be able to allay my fears; if the negotiation to encrypt is in plaintext, surely an adversary can rewrite those negotiating packets to say that one side or the other doesn't support encryption, and then the session continues as plaintext?