Page MenuHomePhabricator

Protect outgoing emails with SMTP STARTLS
Closed, DuplicatePublic

Description

When sodium (lists) or polonium (otrs) delivers an email message (such as mailing list delivery) to a remote server, it does so in plaintext even if the remote smtp server supports STARTTLS (rfc3207).

Expected:
The local exim should be negotiating a TLS connection using STARTTLS (and preferably, verifying the certificate when sending to the Big Players).

I should point out that in addition of mailing lists publicly archived (and staff addresses), we also have password resets, emails with personal information being sent to OTRS or private mailing lists (stewards, checkusers, oversighters, otrs agents...) so, assuming they are using a that also supports TLS smtp, we could have the message protected from the point it enters Wikimedia systems.

Event Timeline

Platonides raised the priority of this task from to Normal.
Platonides updated the task description. (Show Details)
Platonides added subscribers: Platonides, csteipp.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 4 2015, 10:14 PM
csteipp set Security to None.Jun 5 2015, 1:17 AM
csteipp added a subscriber: MoritzMuehlenhoff.

I would really like to see us do this part.

Krenair added a subscriber: Krenair.Jun 9 2015, 9:57 PM
Chmarkine added a subscriber: Chmarkine.
Dzahn added a comment.Aug 5 2015, 6:26 PM

please continue discussion on T82576 (since that was the older ticket). i wish we could have actually merged content like in RT but that is not possible

Dzahn closed this task as Invalid.Aug 5 2015, 6:27 PM
Dzahn claimed this task.
Restricted Application removed a subscriber: Liuxinyu970226. · View Herald TranscriptAug 5 2015, 6:27 PM
Dzahn added a comment.Aug 5 2015, 6:29 PM

added @Platonides and @Chmarkine to linked ticket. let us know if any access issues.

I'm afraid I don't have access there, Dzahn: «You do not have permission to view this object.». It expects me to be either on WMF-NDA or a task owner.

I'm afraid I don't have access there, Dzahn: «You do not have permission to view this object.». It expects me to be either on WMF-NDA or a task owner.

--> T110432