Assume Mallory knows the server, username and password that Alice uses to send email via smtp. Can Mallory read Alice's email? Does it depend on the specific system or configuration?

  • Are you asking whether SMTP credentials can always be used to access IMAP/POP? – Fire Quacker Jan 22 at 17:51

Many ISP-hosted outgoing SMTP servers simply provide relaying of outgoing messages, without providing any type of mailbox functionality and/or message storage and retrieval functionality. If that's the case - then, if Mallory has Alice's username and password for the SMTP server, then Mallory would be able to send messages through Alice's account, but Mallory would not be able to access messages that Alice has sent through the server.

But, all bets are off if the SMTP server also has mailbox functionality or message storage and retrieval functionality, or integrates with an IMAP server, or the like, (or if Alice uses the same username and password for her POP3 or IMAP server).

| improve this answer | |


It depends on what controls there are. Credentials alone will not work if:

  • processes limit which IPs can connect
  • processes look for anomalies in what is connecting
  • Multi-factor authentication
  • the credentials are only for sending and not accessing mailboxes
| improve this answer | |

Your Answer

