5
2
At the ServerFault question "Is STARTTLS more safe than TLS/SSL?" it came up that the question is really about Thunderbird rather than the actual protocols. Also, if you Google about this topic you will find many different answers contradicting each other.
Thunderbird (talking about current version 17, but it's like this since version 3) offers three methods of encrypting transfers, in the configuration dialog:
- None
- SSL/TLS
- STARTTLS
And in Thunderbird before version 3, there were these options:
- None
- SSL
- TLS
- TLS, if available
With Thunderbird version 3 the "SSL" option was renamed to "SSL/TLS", and the last two options were merged and renamed to "STARTTLS". STARTTLS became the default configuration option.
However, according to this question and answer, when using STARTTLS, Thunderbird could fall back to plaintext transfer without notifying me!
My questions are:
- Can Thunderbird really fall back to plaintext transfer without telling me, and establish the connection anyway (which would be a security risk)?
- Which versions of SSL, TLS and STARTTLS does Thunderbird support?
- Is there some indicator in Thunderbird to show which encryption method (protocol and version) is actually being used?
- Is there a way to force Thunderbird to use TLS and if not supported by server to not connect at all? (The "SSL/TLS" option seems it can't handle TLS (I tried it), and STARTTLS which can do TLS may have the "silent fall back" security risk.)