That is why one should always use the appropriate "s" port if possible, like in imaps, pop3s or smtps. Then downgrade to TLS-less via fiddling with the STARTTLS exchange maliciously or through a bug is impossible.
Imho STARTTLS needs to die. Maybe thats impossible for SMTP, but for everything else we can and should get rid of it!
Imho STARTTLS needs to die. Maybe thats impossible for SMTP, but for everything else we can and should get rid of it!