即使没有在同一台计算机上使用不带SSL / TLS的SMTP发送电子邮件也不安全吗？

Question

I'm writing a rails application where I have to send emails (for password reset/ contact form etc..). And I can get the email to work without SSL/TLS but with SSL/TLS it always results in a timeout.

The question I have is how insecure is it to not use SSL/TLS? Is not using SSL/TLS not a problem if my rails application and the mail server are located in the same machine? Does not using SSL/TLS mean that only the communication between my rails app and the mail server is not secure but the communication between the mail server and recipient will still be secure?

For your information, following is my rail mail configuration. Do you see anything wrong with that?

  config.action_mailer.delivery_method = :smtp
  config.action_mailer.smtp_settings = {
                  address:              'secure.mailserver.com',
                  port:                 465,
                  user_name:            'no-reply@mydomain.org',
                  password:             'password',
                  enable_starttls_auto: true,
                  authentication:       "plain"
          }

Answer 1

Is not using SSL/TLS not a problem if my rails application and the mail server are located in the same machine?

There's very little point in using SSL/TLS from localhost to localhost in general.

Does not using SSL/TLS mean that only the communication between my rails app and the mail server is not secure but the communication between the mail server and recipient will still be secure?

The communication between your mail server (the MSA ) and the recipient can't be assume to be secure (MSAs and MTAs generally don't use SSL/TLS between them, or at least you can never make this assumption).

If you want e-mail security up to the recipient, use message-level encryption (eg S/MIME).

The SSL/TLS encryption between the Mail User Agent (your Rails app, or Thunderbird, ...) and your MSA (the server it connects to) is generally useful when you need to provide a password to authenticate to that server. It's also useful for the general transport-level security, at least against potential attackers located between your user agent and the server (eg if you're on a public network).

In your configuration, you're using port 465 and STARTTLS. Generally, port 465 is for SMTPS (SMTP over SSL/TLS, where the SSL/TLS channel is established first), whereas port 587 is used for SMTP+STARTTLS (where there's some plain SMTP traffic before an upgrade to SSL/TLS via STARTTLS ). (More details here .)