Some of the many dumb things about the Guccifer story.

[YouDig]

25. OK, so Guccifer's explanation of how he got in is bogus.

The outdated email software has absolutely nothing to do with the Guccifer story, because Guccifer didn't claim he hacked the email server, he claimed that he hacked in through an open port, but somehow declined to specify which port and how he got access through it.

Running outdated software is obviously not ideal, but it doesn't make it "easy" to hack by any means. Like I said in the OP, even if client-server communications are unencrypted, to sniff packets or spoof you actually have to control a node in between the client and the server. I don't know if it had any protection against brute-force attacks or not, but brute-force attacks definitely leave traces in logs, and there were no traces found in the logs.

And the bottom line is, email is insecure. It's arguable whether a private server, even running outdated software, is less secure than gmail or .gov, for a lot of reasons. Most hacks aren't spoofing or anything technical, they are social engineering, bad passwords, etc. With a large administered system, there are a lot more ways in. There are a lot more IT people to convince to reset your password. And then there are Edward Snowdens, who it is really hard to protect against in a big organization.

The biggest leaks of classified information we've seen, Snowden and Manning, didn't arise from weak encryption software or outdated certificates, they were simply due to humans who had access. So I think, all things considered, her emails were likely more secure on that home server than on .gov.