exit policy

[Dominik Schaefer]

Andrew schrieb:
> NavouWiki schrieb: As for end-to-end encryption, you could allow exit only
> to ports that are commonly used by encrypted protocols (like 443 for https,
> 465 for SMTPS, 993 for IMAPS... browse wikipedia to continue that list to
> your satisfaction).
I just want to add: The recommended way to do encrypted smtp, imap, pop3 is to
use the the 'old' ports and issue a STARTTLS/STLS command at the beginning of
the communication which switches to TLS.
Also see:
http://tools.ietf.org/html/rfc2595
http://tools.ietf.org/html/rfc3207

(There is also a STARTTLS for http (http://tools.ietf.org/html/rfc2817), but I
don't know if any websites make use of it.)

But the message is again: don't rely on port numbers. ;-) Connections to Ports
25, 110, 143 may be encrypted and 'safe' as well.
(Additionally there is no real reason to expect 'bad guys' using only
unencrypted connections. ;-) )

Dominik