A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems

Various email protocols, including IMAP, POP3, and SMTP, were originally designed as "plaintext" protocols without inbuilt confidentiality and integrity guarantees.To protect the communication traffic, TLS can either be used implicitly before the start of those email protocols, or introduced as an opportunistic upgrade in a post-hoc fashion.In order to improve user experience, many email clients nowadays provide a so-called "auto-detect" feature to automatically determine a functional set of configuration parameters for the users.In this paper, we present a multifaceted study on the security of the use of TLS and auto-detect in email clients.First, to evaluate the design and implementation of client-side TLS and auto-detect, we tested 49 email clients and uncovered various flaws that can lead to covert security downgrade and exposure of user credentials to attackers.Second, to understand whether current deployment practices adequately avoid the security traps introduced by opportunistic TLS and auto-detect, we collected and analyzed 1102 email setup guides from academic institutes across the world, and observed problems that can drive users to adopt insecure email settings.Finally, with the server addresses obtained from the setup guides, we evaluate the sever-side support for implicit and opportunistic TLS, as well as the characteristics of their certificates.Our results suggest that many users suffer from an inadvertent loss of security due to careless handling of TLS and auto-detect, and organizations in general are better off prescribing concrete and detailed manual configuration to their users.In this study, we consider three perspectives of the email ecosystem in tandem.First, we evaluate the designs and implementations of client applications (apps).This allows us to identify flaws in the clients that can lead to inadvertent security downgrades, which could in turn nullify the protections of TLS and leak sensitive messages and user credentials.Second, with the potential security traps due to auto-detect and other design weaknesses already identified, we evaluate email setup guides that are prescribed by IT admins of academic institutes around the world, to see if they adequately instruct users on how to avoid the traps, and adequately protect the sensitive traffic of the email protocols.This allows us to observe and better understand the current deployment practices embraced by real-world production setups.Finally, using the server addresses identified from the setup guides, we evaluate the server-side support for implicit and opportunistic TLS, as well