Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

21–30 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#21

Post by jonathantf2 »

belorn wrote: post #19

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or s…

This is completely false, I've just installed the Mail app on my Windows 11 machine, first thing it asks you is what e-mail provider you use [0] and there are options for iCloud, Yahoo and a generic IMAP setup along with the Microsoft offerings.

[0] https://files.catbox.moe/ljil4h.png

Re: When did POP and IMAP become a “legacy protocol?”

#22

Post by oddlama »

hsbauauvhabzb wrote: post #13
chowells wrote: post #9

Earlier quoted context omitted.

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

Exactly what risk does it have being on a low profile blog?

I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.

Re: When did POP and IMAP become a “legacy protocol?”

#23

Post by okasaki »

> I do have to wonder how long until Google decides that only certain clients can connect with Gmail?

Already the case on mobile:

> If you use the Play store or GitHub version of FairEmail, you can use the quick setup wizard to easily setup a Gmail account and identity. The Gmail quick setup wizard is not available for third party builds, like the F-Droid build because Google approved the use of OAuth for official builds only. OAuth is also not available on devices without Google services, such as recent Huawei devices, in which case selecting an account will fail.

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-co...

Re: When did POP and IMAP become a “legacy protocol?”

#24

Post by seanp2k2 »

mattgreenrocks wrote: post #5
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

Shaming people for not having HTTPS on their blog is not a great look. :/

What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)

Re: When did POP and IMAP become a “legacy protocol?”

#25

Post by pvorb »

Dylan16807 wrote: post #17
mattgreenrocks wrote: post #5

Earlier quoted context omitted.

Shaming people for not having HTTPS on their blog is not a great look. :/

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.

Re: When did POP and IMAP become a “legacy protocol?”

#26

Post by handsclean »

hsbauauvhabzb wrote: post #13
chowells wrote: post #9

Earlier quoted context omitted.

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

Exactly what risk does it have being on a low profile blog?

It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.

Re: When did POP and IMAP become a “legacy protocol?”

#27

Post by vlovich123 »

seanp2k2 wrote: post #24
mattgreenrocks wrote: post #5

Earlier quoted context omitted.

Shaming people for not having HTTPS on their blog is not a great look. :/

What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)

So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site.

All of this was present in the 90s and early 2000s so not really theoretical attacks.

Re: When did POP and IMAP become a “legacy protocol?”

#28

Post by bayindirh »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost.

If you're not doing anything requiring security, you don't need HTTPS, IMHO.

> POP should really be considered legacy

I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly.

Similarly, I'll let the wisdom of "Teh Internetz" to decide whether JMAP is worthy of the effort to replace IMAP. Having a IETF RFC is a good start, but let's see...

Re: When did POP and IMAP become a “legacy protocol?”

#29

Post by pvorb »

deaddodo wrote: post #20
Angostura wrote: post #11

Earlier quoted context omitted.

> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.

So does IMAP? Most clients only cache headers because it’s faster and most devices are always-connected; but you can certainly locally download the entirety of your IMAP contents. Considering you have to download the entirety of the mail contents to read it anyways, I have no idea what makes you think this is an impossibility.

Yeah, but typically the difference is that you can't see IMAP as a backup. Whereas with POP3 (and not having your client set up to automatically delete emails on the server) you can.

With IMAP, when an email gets deleted by some client, other clients will also delete their local copies of that email. That won't happen with POP3.

But I haven't read either of the two protocols, so I'm not sure whether that's something required by the protocol or just a common behavior of clients.

Re: When did POP and IMAP become a “legacy protocol?”

#30

Post by bayindirh »

vlovich123 wrote: post #27
seanp2k2 wrote: post #24

Earlier quoted context omitted.

What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)

So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.

> inject ads.

If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you.

They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.

Post reply on HN