Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

41–50 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#41

Post by bayindirh »

cortesoft wrote: post #35
bayindirh wrote: post #28

Earlier quoted context omitted.

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

Re: When did POP and IMAP become a “legacy protocol?”

#42

Post by shadowgovt »

pvorb wrote: post #25
Dylan16807 wrote: post #17

Earlier quoted context omitted.

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.

For most modern blog hosts, it's a pushbutton solution or automatic.

For self-hosted, it's table-stakes knowledge. Failure to do it implies the site admin knows so little about modern security that their access logs are probably only thinly secured. It's an "admin smell," if you will.

Re: When did POP and IMAP become a “legacy protocol?”

#43

Post by johnklos »

Dylan16807 wrote: post #17
mattgreenrocks wrote: post #5

Earlier quoted context omitted.

Shaming people for not having HTTPS on their blog is not a great look. :/

Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.

The same people who'd claim http is a bad look would also tell you to pipe curl to bash with sudo.

Re: When did POP and IMAP become a “legacy protocol?”

#44

Post by cortesoft »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.

Re: When did POP and IMAP become a “legacy protocol?”

#45

Post by [deleted] »

Angostura wrote: post #11
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.

[deleted]

Re: When did POP and IMAP become a “legacy protocol?”

#47

Post by cma »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

Comcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).

Re: When did POP and IMAP become a “legacy protocol?”

#48

Post by bayindirh »

cortesoft wrote: post #39
bayindirh wrote: post #30

Earlier quoted context omitted.

> inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.

That is not possible. You would get a cert mismatch error.

The overall connection will drop to "mixed status", but the inner frame will still be HTTPS.

My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages.

My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o disturbing the connection too much.

So, having a HTTPS connection doesn't make it tamper resistant, but tamper evident, at most.

Re: When did POP and IMAP become a “legacy protocol?”

#49

Post by nulbyte »

bayindirh wrote: post #30
vlovich123 wrote: post #27

Earlier quoted context omitted.

So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.

> inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.

Unless the ISP forces the use of its own Certificate Authority on its users, this isn't possible. TLS and the infrastructure surrounding it were designed with integrity of the connection in mind. Knowing this, I would be very curious to know what specifically you encountered and where. I see you added some details elsewhere, but it still doesn't jive with how TLS works.

Re: When did POP and IMAP become a “legacy protocol?”

#50

Post by gkbrk »

cma wrote: post #47
bayindirh wrote: post #41

Earlier quoted context omitted.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

Comcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).

If Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?
Post reply on HN