Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Warning: Heficed Intercepts SMTP Connections to Spy on your Mail! - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Warning: Heficed Intercepts SMTP Connections to Spy on your Mail!

2»

Comments

  • jarjar Patron Provider, Top Host, Veteran
    edited November 2021

    @darkimmortal said: Getting the expected STARTTLS connection with google cert on OVH (Kimsufi). Can you explain further what filtering they do? Should I be worried using them for personal email?

    I don't know how they do it, but they're not using the same stuff. Some Vade Retro equipment last I recall.

    @rm_ said: Not getting any TLS stripping on my KS either. Don't try to legitimize a shady practice with vague hand-waving at a well-known provider implying "everyone does that".

    Read:

    @jar said: OVH's is better and more hidden, but I learned about it when I ran an inbound relay there. It accepted mail, held it, and then delivered to my other servers outside of their network. One day they blocked SMTP and emailed me a list of email subjects that they deemed spam leaving their network. They only went out to my servers.

    It happened. How much you like your kimsufi has zero to do with anything.

    It's hard out there to handle this stuff at scale and every option comes with positives and negatives. It's not justifying it to talk about the options, the struggles, and whether or not this is slowly becoming a normal practice. I know a few things, I'm not just flapping my jaw because it feels good. You know damn well this is the topic of what I do for a living, that's why I faced it at OVH and why I paid Heficed to opt my account out of it.

  • rm_rm_ IPv6 Advocate, Veteran
    edited November 2021

    @jar said: One day they blocked SMTP and emailed me a list of email subjects that they deemed spam leaving their network. They only went out to my servers.

    Are you sure you had TLS set up between your servers, and they weren't just communicating in plain-text to begin with?

    Secondly, if something happened in your case once years ago, it is not enough to conclude (as your message reads) that they capture all mail and have been doing so to everyone, continuously over many years. It could be that their stripping only starts depending on other factors, such as the frequency of port 25 connections. But there is not enough proof to back up or disprove that either.

  • jarjar Patron Provider, Top Host, Veteran
    edited November 2021

    @rm_ said: Are you sure you had TLS set up between your servers, and they weren't just communicating in plain-text to begin with?

    No, back then TLS over inbound wasn't common. So it's quite likely they only scan unencrypted traffic. Then again, the encryption happens after connection so I don't know.

    @rm_ said: if something happened in your case once years ago, is not enough to conclude (as your message reads) that they capture all mail and have been doing so continuously over many years

    It's precisely enough to conclude that. If they did it and they've made no statement about no longer doing it (despite never directly making the statement that they did), you should assume that they still are. That's why I send everything out over an alternate port through their network. If the behavior is as shady as you suggest it is, and I'm not particularly denying that it is a bit shady, why would you expect someone who started doing it to quietly stop?

    @rm_ said: But there is no proof to back that up either.

    You're welcome to think I'm a liar. That I just make up stories. I'm financially invested into OVH right now, I have no reason to make up negative experiences as a customer there over the years. A valid question might be what your financial interest is in downplaying my experience.

    Found an old post of me mentioning it before, this isn't something new: https://www.lowendtalk.com/discussion/comment/1111056/#Comment_1111056

  • rm_rm_ IPv6 Advocate, Veteran
    edited November 2021

    @jar said: A valid question might be what your financial interest is in downplaying my experience.

    My interest is that we ensure it isn't OK to do for Heficed because oh come on, OVH and everyone already do that (whether "supposedly" or not).

    Thanked by 1jar
  • jarjar Patron Provider, Top Host, Veteran
    edited November 2021

    @rm_ said: My interest is that we ensure it isn't OK to do for Heficed because oh come on, OVH and everyone already do that (whether "supposedly" or not).

    It's not okay. It's never okay to intercept customer traffic and process it's contents without them being aware, not even if it's law enforcement. I'm simply saying it's not new, and that OVH has done it to me. Admittedly I don't see how OVH would do it today with STARTTLS being common after connection on outbound mail over port 25, so they might not, or maybe their scope has changed for it.

    Thanked by 1BlueMatt
  • @jar said: It's not okay. It's never okay to intercept customer traffic and process it's contents without them being aware, not even if it's law enforcement

    Erh, provider's network = their network, their rules

  • jarjar Patron Provider, Top Host, Veteran
    edited November 2021

    @ferefient said: Erh, provider's network = their network, their rules

    Even if I rent underwear it's a reasonable expectation that you don't sniff it while I'm wearing it. At least, let me know ahead of time that it's the plan lol

  • netomxnetomx Moderator, Veteran

    @jar said: you don't sniff it while I'm wearing it

    oh come one hahahaha

    Thanked by 1jar
  • TimboJonesTimboJones Member
    edited November 2021

    @jar said:
    Admittedly I don't see how OVH would do it today with STARTTLS being common after connection on outbound mail over port 25, so they might not, or maybe their scope has changed for it.

    That's all his point was.

    All you wanted to say is that they do some sort of filtering (whatever the purchased box does), not to specifically say they strip the encryption and force it to plaintext.

    Thanked by 1jar
  • @jar said:

    @ferefient said: Erh, provider's network = their network, their rules

    Even if I rent underwear it's a reasonable expectation that you don't sniff it while I'm wearing it. At least, let me know ahead of time that it's the plan lol

    More analogies should use rented underwear.

    Thanked by 1jar
Sign In or Register to comment.