On 12/04/2019 12:50, Anders Gustafsson wrote:
> Dave Howe,
>> TLS for SMTP can be trivially broken in MITM attacks by hiding the
>> "STARTTLS" offer during ehlo.

> That is true, but what additional protection does the O365-way give?
> None IMHO.

a little, but very little. The same is true of the other offerings I
mentioned though; MS is offering this to compete in a market, and is not
noticeably worse than most (although I note pgp universal *will* allow
you to log onto it and upload your pgp key, so future emails are
conventionally encrypted with pgp, rather than using their "oracle" system.)