On Fri, May 02, 2014 at 12:55:07AM -0400, David Patte ₯ wrote:
> Many websites currently use a persons email address and password as a way of
> insuring security for logging into a website.
*Supposedly*.
> If someone has an existing email mailbox specified by a particular email
> address, can anyone on this list imagine any easy way that people can
> intercept email sent to that address without knowing the person's password
> at the mailbox site?
Sure! Be root on the mail server and just peek at the mail spool.
In all due seriousness though, that's very environment specific. I can't
really provide a generic answer. Provided that basic security is in
place, no, but you can't assume that it can be done easily. Still:
* How many sites don't do TLS (and please, SMTP+STARTTLS and TLS ≥ 1.2
ideally, not SMTPS)? IP traffic can and has been subverted en masse.
* How many use export-grade ciphers?
* How many accept certificates issued by untrusted CAs? Think of
China and some businesses with man-in-the-middling firewalls.
* How many end up having some relay in the clear at some point?
* How many store emails on insecure storage?
* How many are operated by untrusted administrators?
And then there's poorly implemented SMTP [^1] servers.
I'd look at how SMTP works first, if you want to understand.
I recently advised a family member against providing credit card
information over email sent to someone whose mail server only did SMTP
in the clear. Scary how incompetent (and I do not use that word lightly,
given the stakes) some mail server administrators are. There's missteps
with little practical impact for what matters, then there's negligence.
[^1]: Anybody still using UUCP, or have a need for LMTP?
Regards,
Alex Pilon
Attachment:
pgphDd2iCdWHn.pgp
Description: PGP signature