https://peertube.watch/videos/watch/399e8ed9-9f62-44e8-90ec-0eb43872361f TLS is one of today's most widely used and best-analyzed encryption technologies. However, for historical reasons, TLS for email protocols is often not used directly but negotiated via STARTTLS. This additional negotiation added complexity and was prone to security vulnerabilities such as naive STARTTLS stripping or command injection attacks in the past. We performed the first structured analysis of STARTTLS in SMTP, POP3, and IMAP and introduced a semi-automatic testing toolkit (EAST) to analyze email clients. We used EAST to analyze 28 email clients and 23 email servers, resulting in over 40 STARTTLS related issues. Only 3 out of 28 clients and 7 out of 23 servers did not show any STARTTLS-specific security issues. We conclude that STARTTLS is error-prone to implement, under-specified in the standards, and should be avoided. Speaker: Fabian Ising, Track: Modern Email devroom, Room: H.2213, When: Sunday 4 February 2024, 09:05–09:25 (Brussels time), Schedule: FOSDEM 2024 event page, Slides & links Slides, Licence: Creative Commons Attribution 2.0 Belgium (CC BY 2.0 BE) (as stated in the FOSDEM video archive). Attribution: “[Protocols] Security of STARTTLS in the E-Mail Context” by Fabian Ising, FOSDEM 2024. Original recording: 2024/h2213/fosdem-2024-2179--protocols-security-of-starttls-in-the-e-mail-context.av1.webm from the FOSDEM video archive. This channel is an unofficial mirror; FOSDEM is a free and non-commercial event organised by the community for the community. Sat, 24 Oct 2026 01:32:15 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.watch https://peertube.watch/lazy-static/avatars/3b284627-b75f-409e-ac2e-10f4c2946f43.png https://peertube.watch/videos/watch/399e8ed9-9f62-44e8-90ec-0eb43872361f All rights reserved, unless otherwise specified in the terms specified at https://peertube.watch/about and potential licenses granted by each content's rightholder.