Mail accounts with and without SSL

[Hubbaman]

Hi,
Sorry if this is too far off topic, but I'd like to ask this as a follow up to this thread:
http://forum.avast.com/index.php?topic=78214.0

My recent mail problems (solved) got me thinking. My mail account with my ISP uses SSL. I also have mail accounts for a domain I own, hosted through a web hotel. These are not secured with SSL. I am investigating how I can set this up with them now, it seems I have to pay an extra fee, hopefully not much.

I wonder what the risks are in using mail accounts without SSL? I connect from home using my ADSL connection. However, I have sometimes logged into my mail accounts using the web interface which has been http and not https.

And by the way, why are non-SSL accounts listed under SSL accounts in Avast? (They are marked with Encryption: None.)

[DavidR]

Well they can be intercepted during transit, but that really is trying to shoot a moving target. They would also be either trying random IP addresses to try to monitor/intercept http/smtp traffic or targeting a specific IP address.#

All of this makes the actual chances of your email traffic http or smtp/pop3 a bit of a low risk.

I don't use webmail, generally only through an email client (currently thunderbird). I haven't specifically used SSL email in all the time I have been using the Internet (quite some time) and I haven't had an email account compromised (e.g. user name and password harvested).

Only recently since getting broadband one of my email accounts btinternet, which uses Yahoo to handle mail does it get sent using SSL. This email account however, I very rarely use as I too have my own domain name and email hosting for that and it isn't SSL either. I haven't considered upgrading that email hosting service to SSL as I personally don't think the risk great enough for the content of my emails.

[Hubbaman]

Thanks. So we are in the same boat. 

I have never found any indications that my accounts have been compromised. I guess there might be a chance that e-mail contents could be compromised, though? Anyway, I take care not to send very sensitive information by e-mail.

[DavidR]

Yes, the argument goes out of the window if the content of the email is sensitive/confidential/business, etc. But for rare occasions it could be sent in a zipped password protected attachment, sending the password in a separate email.

[sded]

Greatest risk of compromise of open email would be if you use wireless without WPA encryption of the link, as many public services do.  Any sniffer can then read all of the mail transmitted and received on that AP that does not use SSL.  For wired, you are at risk at all of the relays/servers along the way, but they are much more difficult to compromise.  Unless maybe you are worried about the Government.  Then use something like PGP in addition. 

[DavidR]

Thanks for the reminder about PGP I had completely forgotten about that.

Edit: and now the bad news.

PGP and Symantec are now one company. We are currently in the process of migrating content and functionality from the Altiris websites, and have created ...

I didn't know they had been taken over by the devil incarnate.

[sded]

Complain to the NSA then.  Oh wait; you are not in the US anyway.   

[Hubbaman]

Great. Thanks for the info!