Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

31–40 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#31

Post by 1vuio0pswjnm7 »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

"Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost."

This blog can be read over TLS using gemini://.

    printf 'gemini://gemini.conman.org/boston/2022/09/22.1\r\n' \
    |openssl s_client -connect 71.19.142.20:1965 -ign_eof
Also

https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...

Re: When did POP and IMAP become a “legacy protocol?”

#32

Post by rizky05 »

chowells wrote: post #9
mattgreenrocks wrote: post #5

Earlier quoted context omitted.

Shaming people for not having HTTPS on their blog is not a great look. :/

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

No post body was provided.

Re: When did POP and IMAP become a “legacy protocol?”

#33

Post by Ferret7446 »

pvorb wrote: post #25
Dylan16807 wrote: post #17

Earlier quoted context omitted.

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.

No post body was provided.

Re: When did POP and IMAP become a “legacy protocol?”

#34

Post by sgtnoodle »

pvorb wrote: post #25
Dylan16807 wrote: post #17

Earlier quoted context omitted.

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.

I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitely wasn't trivial.

Re: When did POP and IMAP become a “legacy protocol?”

#35

Post by cortesoft »

bayindirh wrote: post #28
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO.

I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages.

I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Re: When did POP and IMAP become a “legacy protocol?”

#36

Post by jeroenhd »

advisedwang wrote: post #4
ljlds3da wrote: post #2

Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue.

I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key?

This can all be standardised without a browser ever touching the email client. We already have IMAP authentication methods that use signatures (like most 2FA hardware keys use) or challenge/response methods. You can even do client certificate authentication through STARTTLS when lacking a TPM.

Re: When did POP and IMAP become a “legacy protocol?”

#37

Post by johnklos »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading.

Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols".

That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

Re: When did POP and IMAP become a “legacy protocol?”

#38

Post by shadowgovt »

1vuio0pswjnm7 wrote: post #31
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

"Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost." This blog can be read over TLS using gemini://. printf 'gemini://gemini.conman.org/boston/2022/09/22.1\r\n' \ |openssl s_client -connect 71.19.142.20:1965 -ign_eof Also https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...

Do either of these address the underlying problem that without https there's no guarantee that the blog content hasn't been modified in transit?

Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?

Re: When did POP and IMAP become a “legacy protocol?”

#39

Post by cortesoft »

bayindirh wrote: post #30
vlovich123 wrote: post #27

Earlier quoted context omitted.

So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.

> inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.

That is not possible. You would get a cert mismatch error.

Re: When did POP and IMAP become a “legacy protocol?”

#40

Post by belorn »

jonathantf2 wrote: post #21
belorn wrote: post #19

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or s…

This is completely false, I've just installed the Mail app on my Windows 11 machine, first thing it asks you is what e-mail provider you use [0] and there are options for iCloud, Yahoo and a generic IMAP setup along with the Microsoft offerings. [0] https://files.catbox.moe/ljil4h.png

Maybe it depend on which license/tablet? I have worked with customers with that issue in the past and the option for generic imap has not been there.

Double checked and you are right, it was this issue that I recalled: https://support.microsoft.com/en-us/office/add-your-other-em...

Post reply on HN