When did POP and IMAP become a “legacy protocol?”

Post by bayindirh » Sun, Sep 25, 2022, 11:26 PM UTC

nulbyte wrote: post #49

bayindirh wrote: post #30

Earlier quoted context omitted.

> inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.

Unless the ISP forces the use of its own Certificate Authority on its users, this isn't possible. TLS and the infrastructure surrounding it were designed with integrity of the connection in mind. Knowing this, I would be very curious to know what specifically you encountered and where. I see you added some details elsewhere, but it still doesn't jive with how TLS works.

Post by 0x457 » Sun, Sep 25, 2022, 11:32 PM UTC

pvorb wrote: post #29

deaddodo wrote: post #20

Earlier quoted context omitted.

So does IMAP? Most clients only cache headers because it’s faster and most devices are always-connected; but you can certainly locally download the entirety of your IMAP contents. Considering you have to download the entirety of the mail contents to read it anyways, I have no idea what makes you think this is an impossibility.

Yeah, but typically the difference is that you can't see IMAP as a backup. Whereas with POP3 (and not having your client set up to automatically delete emails on the server) you can. With IMAP, when an email gets deleted by some client, other clients will also delete their local copies of that email. That won't happen with POP3. But I haven't read either of the two protocols, so I'm not sure whether that's something…

Post by davidro80 » Sun, Sep 25, 2022, 11:39 PM UTC

bayindirh wrote: post #41

cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

Post by dhiggdyjkb » Sun, Sep 25, 2022, 11:40 PM UTC

bayindirh wrote: post #48

cortesoft wrote: post #39

Earlier quoted context omitted.

That is not possible. You would get a cert mismatch error.

The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o…

Post by bayindirh » Sun, Sep 25, 2022, 11:41 PM UTC

vlovich123 wrote: post #54

bayindirh wrote: post #48

Earlier quoted context omitted.

The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o…

Afaik not actually possible in practice. Browsers these days will a) remember valid certs for a domain b) remember that a domain is HTTPS (no downgrades) c) sniff certificates based on crowdsourcing.