No enforcement of STARTTLS.

[duesee]

Offlineimap does not enforce the use of STARTTLS when the server does not advertise the STARTTLS capability. Instead, it will provide the credentials in plaintext.

I wanted to raise the question if this is supposed to stay like this or could possibly be changed such that when STARTTLS is configured it is enforced. In the case the server does not advertise STARTTLS, the correct behaviour should be to provide a hint to use implicit TLS instead (preferred) or to require from the user to explicitly enable this behaviour (with a warning.)

I evaluated that behaviour in a ton of email clients and offlineimap is really one of the very few clients still behaving that way. This should really be changed. See also https://tools.ietf.org/html/rfc8314

Edit: in case STARTTLS will be enforced in the future, the certificate must obviously also be checked. Otherwise this doesn't help a lot :-)

Edit 2: I made the suggestion clearer.

[chris001]

Absolutely agree. Email security is paramount importance! This old way of doing security (silent downgrade to cleartext zero encryption, just to accomplish the goal of running the completing the task) MUST be fixed to enforce encryption and fail with informative message when unable to.

[hartwork]

I believe it's this place in the code that would need adjustment:

offlineimap/offlineimap/imapserver.py

Line 328 in ffbace5

if 'STARTTLS' in imapobj.capabilities and not self.usessl:

or could possibly be changed such that when STARTTLS is configured it is enforced.

Maybe that fix would just be:

- if 'STARTTLS' in imapobj.capabilities and not self.usessl:
+ if not self.usessl:

[hartwork]

@nicolas33 could you re-classify this from feature to security please?

[nicolas33]

Please, go to offlineimap3.

[keithbowes]

Maybe that fix would just be:

• if 'STARTTLS' in imapobj.capabilities and not self.usessl:

• if not self.usessl:

Wouldn't that still execute the code when using STARTTLS as well as when STARTTLS isn't being used? Perhaps it would be better to completely remove the code block, so that nothing will happen if using STARTTLS without SSL/TLS enabled (perhaps raising an exception so that users will know that SSL/TLS has to be enabled with STARTTLS).

[hartwork]

@keithbowes you have a point: my patch "breaks" use of IMAP without any form of transport layer security. If that breakage is wanted, an error message asking to adjust the config may be better UX.