Get the latest tech news
Vulnerabilities show why STARTTLS should be avoided if possible (2021)
Guest Post: Study finds more than 40 STARTTLS-related security flaws in many different software products, both client-side and server-side.
All the above vulnerabilities stem from the fact that STARTTLS introduces a state transition between an unencrypted and encrypted connection that is error-prone. We recommend that server operators of mail services make sure they offer the implicit TLS versions of all three email protocols. Ideally, future mail clients would neither offer unencrypted nor STARTTLS connections and just always use implicit TLS.
Or read this on Hacker News
