What may be slightly confusing is that the classes and methods are still present even in the latest. The crux of the matter is that SmtpClient is not going to be further developed to add features, such as for Opportunistic TLS, the official recommendation has been to no longer use this product. Unfortunately, this class does not support many of the modern encryption protocols and therefore, cannot guarantee a secure connection. So as useful as this cmdlet is, why is it no longer considered secure? Underneath, this PowerShell cmdlet uses the SmtpClient. Harry Sintonen of WithSecure underlines that with Office 365 Message Encryption the content of the encrypted messages isn’t directly decipherable, but structural information about those messages can be captured.Īn attacker able to collect multiple encrypted messages can look for patterns that could lead to parts of the message to become gradually readable without the need of an encryption key.Not seeing the video? Make sure your ad blocker is disabled. This weakness was highlighted again in 2020 when it was discovered that the widely used teleconference application Zoom used the same 128-bit key to encrypt all audio and video using the AES algorithm with ECB mode. The issue was highlighted after the massive Adobe data breach in 2013 when tens of millions of passwords were leaked and researchers discovered that the company used ECB mode to encrypt the data, making it possible to obtain plaintext passwords.

The main problem with ECB is that repetitive areas in the plaintext data have the same encrypted result when the same key is used, thus creating a pattern. However, the feature encrypts the data using the Electronic Code Book (ECB) mode, which allows inferring the plaintext message under certain conditions. Organizations use Office 365 Message Encryption to send or receive emails, both external and internal, to ensure confidentiality of the content from destination to source. Security researchers at WithSecure, previously F-Secure Business, found that it is possible to partially or fully infer the contents of encrypted messages sent through Microsoft Office 365 due to the use of a weak block cipher mode of operation.

Microsoft secure email power shell