Attention all pipex/tiscali mail users

cmhuddart101 — Mon, 01 May 2023 22:24:05 GMT

Hi the recent change made by talktalk to "enforce encrypted mail access" has broken the following tls1.3 capable mail client.

Thunderbird

Outlook

any android device

it will also affect any tls1.3 capable devices and mail clients that support tls1.3.
The server is currently misconfigured for tls1.3 and sends tls1.2 to a cleint tls1.3 connect request as shown below.

Working imap connection to an imap server correctly configured for tls1.2
Frame 12: 1500 bytes on wire (12000 bits), 1500 bytes captured (12000 bits) on interface \Device\NPF_{A6ABBF3F-4835-41BB-9C1D-FE553DAF1657}, id 0
Ethernet II, Src: SkyUk_ec:ae:f1 (80:72:15:ec:ae:f1), Dst: RivetNet_18:ed:1d (9c:b6:d0:18:ed:1d)
Internet Protocol Version 4, Src: 213.120.69.1, Dst: 192.168.0.2
Transmission Control Protocol, Src Port: 993, Dst Port: 57371, Seq: 1, Ack: 518, Len: 1446
Transport Layer Security
TLSv1.2 Record Layer: Handshake Protocol: Server Hello
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 63
Handshake Protocol: Server Hello
Handshake Type: Server Hello (2)
Length: 59
Version: TLS 1.2 (0x0303)
Random: bf73444ac65d629b2554b9884babce404dd1582837670d044c8774108446f2ab
Session ID Length: 0
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Compression Method: null (0)
Extensions Length: 19
Extension: renegotiation_info (len=1)
Type: renegotiation_info (65281)
Length: 1
Renegotiation Info extension
Extension: session_ticket (len=0)
Type: session_ticket (35)
Length: 0
Data (0 bytes)
Extension: ec_point_formats (len=2)
Type: ec_point_formats (11)
Length: 2
EC point formats Length: 1
Elliptic curves point formats (1)
Extension: extended_master_secret (len=0)
Type: extended_master_secret (23)
Length: 0
[JA3S Fullstring: 771,49199,65281-35-11-23]
[JA3S: 92b5be817fd08957ff9f1384aa41f438]

Failing connection to mail.talktalk.net incorrectly configured to use tls1.3

Frame 6: 1500 bytes on wire (12000 bits), 1500 bytes captured (12000 bits) on interface \Device\NPF_{A6ABBF3F-4835-41BB-9C1D-FE553DAF1657}, id 0
Ethernet II, Src: SkyUk_ec:ae:f1 (80:72:15:ec:ae:f1), Dst: RivetNet_18:ed:1d (9c:b6:d0:18:ed:1d)
Internet Protocol Version 4, Src: 153.92.174.228, Dst: 192.168.0.2
Transmission Control Protocol, Src Port: 993, Dst Port: 53655, Seq: 1, Ack: 518, Len: 1446
Transport Layer Security
TLSv1.3 Record Layer: Handshake Protocol: Server Hello
Content Type: Handshake (22)
Version: TLS 1.2 (0x0303)
Length: 122
Handshake Protocol: Server Hello
Handshake Type: Server Hello (2)
Length: 118
Version: TLS 1.2 (0x0303)
Random: 6294798c22ce2d0b8ce11f343f85c42943945e412ea87ad7882da911fb508060
Session ID Length: 32
Session ID: 5e88d87fcad63a2f5f80cf80e2711d564a3ca32448458f9f891635018d4b0c83
Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
Compression Method: null (0)
Extensions Length: 46
Extension: supported_versions (len=2)
Extension: key_share (len=36)
[JA3S Fullstring: 771,4866,43-51]
[JA3S: 15af977ce25de452b96affa2addb1036]
TLSv1.3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
Content Type: Change Cipher Spec (20)
Version: TLS 1.2 (0x0303)
Length: 1
Change Cipher Spec Message
TLSv1.3 Record Layer: Application Data Protocol: Internet Message Access Protocol
Opaque Type: Application Data (23)
Version: TLS 1.2 (0x0303)
Length: 27
Encrypted Application Data: 40e7b7469dbb3e53588826fb4d349ca927ee6ddf90d24d114f8b19
[Application Data Protocol: Internet Message Access Protocol]

nslookup imap.dsl.pipex.com

Name: imap.tt.xion.oxcs.net
Address: 153.92.174.228
Aliases: imap.dsl.pipex.com
oxmail.tiscali.co.uk
oxmail.talktalk.net

nslookup imap.dsl.pipex.com

Name: imap.tt.xion.oxcs.net
Address: 153.92.174.228
Aliases: imap.dsl.pipex.com
oxmail.tiscali.co.uk
oxmail.talktalk.net

Re: Attention all pipex/tiscali mail users

KeithFrench — Tue, 02 May 2023 14:07:51 GMT

I think it would be far more readable if you just attached the Wireshark or other trace, rather than just giving a text output of the frame layer upwards.

Re: Attention all pipex/tiscali mail users

Chris-TalkTalk — Fri, 05 May 2023 13:18:47 GMT

Hi cmhuddart101,

I've escalated this, I'll let you know when I have an update

Thanks

Chris

Re: Attention all pipex/tiscali mail users

Ady-TalkTalk — Mon, 22 May 2023 06:08:57 GMT

We're still waiting for a response from the email admins. I've sent another chaser this morning making this the 4th.

Ady

topic Re: Attention all pipex/tiscali mail users in Email

Attention all pipex/tiscali mail users

Re: Attention all pipex/tiscali mail users

Re: Attention all pipex/tiscali mail users

Re: Attention all pipex/tiscali mail users