ISPs caught stripping STARTTLS from email

in security on (#2V0A)
Those evil ISPs are at it again:
Recently, Verizon was caught tampering with its customer's web requests to inject a tracking super-cookie. Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the US and Thailand intercepting their customers' data to strip a security flag—called STARTTLS—from email traffic. The STARTTLS flag is an essential security and privacy protection used by an email server to request encryption when talking to another server or client.1

By stripping out this flag, these ISPs prevent the email servers from successfully encrypting their conversation, and by default the servers will proceed to send email unencrypted. Some firewalls, including Cisco's PIX/ASA firewall do this in order to monitor for spam originating from within their network and prevent it from being sent. Unfortunately, this causes collateral damage: the sending server will proceed to transmit plaintext email over the public Internet, where it is subject to eavesdropping and interception.
Although I wouldn't trust the content of your non-PGP email to ever be secure, this could potentially lead to your email account password being transmitted in-the-clear, depending on how your email client and server are configured.

Fastmail (Score: 2, Interesting)

by on 2014-11-13 13:35 (#2V1M)

Interesting. I use Fastmail (, was before last month) and they not only insist on SSL connection for IMAP but refuse to use StartTLS, and now I understand why. I didn't before. Too bad we're learning everything the hard way!

It pisses me off - you can no longer trust your machine, can't trust your connection, can't trust your ISP, and can definitely not trust your government. Now what? I'm off to buy a typewriter and kickstart a FIDOnet replacement via a RaspbPi node I can run from an underground bunker. We're going from bad to worse here.
Post Comment
What is eighty seven thousand three hundred and forty six as digits?