Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

61–70 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#61

Post by 0x457 »

jeroenhd wrote: post #36
advisedwang wrote: post #4

Earlier quoted context omitted.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already…

> What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key?

Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that.

GitHub alone has like 5 different ways to handle 2FA. Google has, I think, 3? Using a browser to handle this simplifies things a lot.

b) While it's not fixed by Oauth it greatly limits what can happen:

— First, you only need to store a refresh token that can expire and that expiration can be controlled by administrator

— Second, that token has limited scope: password provides access to entire account

— Third, it's clear where it came from — if token gets compromised, you will know where it happened. With password, it's unclear.

Re: When did POP and IMAP become a “legacy protocol?”

#62

Post by cesarb »

bayindirh wrote: post #48
cortesoft wrote: post #39

Earlier quoted context omitted.

That is not possible. You would get a cert mismatch error.

The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o…

> The overall connection will drop to "mixed status", but the inner frame will still be HTTPS.

That is not possible. You would get a cert mismatch error.

Consider what your browser does when you navigate to the page: it directly opens a TLS connection to port 443. There's nothing your ISP can do to force the browser to request the page using a non-TLS connection.

What might have happened, is that you might have carelessly typed the address in your URL bar without the "https://" prefix, as in "www.example.com"; for legacy historical reasons, most browsers (except IIRC some very old browsers from the dialup era, which always required an explicit URL scheme) treated that as if you had prefixed it with http:// (so it actually was the non-HTTPS "http://www.example.com" that you were using). Many sites would then redirect you to the HTTPS site, but your ISP could hijack the page before that redirect (since the redirect was not protected by HTTPS). Had you been careful to always prefix any address you type with "https://", there would be no initial non-HTTPS connection to hijack.

Re: When did POP and IMAP become a “legacy protocol?”

#63

Post by denkmoon »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

DoH is bad use DoT instead.

Re: When did POP and IMAP become a “legacy protocol?”

#64

Post by josephcsible »

denkmoon wrote: post #63
bayindirh wrote: post #41

Earlier quoted context omitted.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

DoH is bad use DoT instead.

This couldn't be further from the truth. DoT is easy to block, so anyone who wants to censor or surveil you will just do so. You should always use DoH instead, since it's way more resistant to blocking.

Re: When did POP and IMAP become a “legacy protocol?”

#65

Post by josephcsible »

cortesoft wrote: post #44
bayindirh wrote: post #41

Earlier quoted context omitted.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.

And if you're using TLS ECH, then they wouldn't even know the host name.

Re: When did POP and IMAP become a “legacy protocol?”

#66

Post by bayindirh »

dhiggdyjkb wrote: post #57
bayindirh wrote: post #48

Earlier quoted context omitted.

The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o…

can you explain further?

Two things have happened in the past.

Scenario a:

1. Navigate to https://www.example.com

2. Arrive at https://www.completelyunrelated-adsite.com while your address bar reads https://www.example.com

They used to do this regardless of your DNS. They directly hijacked that stream/connection.

Scenario b:

1. Navigate to https://www.example.com

2. Get https://www.example.com with an ad-banner on top.

They happened rarely, and never survived a reload or further navigation. They completely stopped after a while.

I have a 4G modem from my mobile carrier. They inject a info popup when I receive an SMS or any other notification' if they can manage it. It's very rare now, too.

Re: When did POP and IMAP become a “legacy protocol?”

#67

Post by mccorrinall »

handsclean wrote: post #26
hsbauauvhabzb wrote: post #13

Earlier quoted context omitted.

Exactly what risk does it have being on a low profile blog?

It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.

If someone wants to track you, they can just mark the frame. Marking packets isn’t anything new,

Re: When did POP and IMAP become a “legacy protocol?”

#68

Post by cesarb »

hsbauauvhabzb wrote: post #13
chowells wrote: post #9

Earlier quoted context omitted.

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

Exactly what risk does it have being on a low profile blog?

Will it always be a "low profile blog"? It just got on the front page of HN, which is not exactly "low profile".

As for what risk, two words: Great Cannon. For those who don't know, it's a well-known MITM attacker which injects JavaScript code on non-HTTPS pages, the injected JavaScript being used to do distributed denial of service attacks on other sites. Using HTTPS protects against these kinds of attacks.

Re: When did POP and IMAP become a “legacy protocol?”

#70

Post by jsnell »

0x457 wrote: post #61
jeroenhd wrote: post #36

Earlier quoted context omitted.

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already…

> What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that. GitHub alone has like 5 differe…

> Google has, I think, 3?

There's at least:

1. SMS

2. TOTP

3. Google Prompt (on Android / iOS)

4. Offline security codes (distinct thing from TOTP, generated from Android settings)

5. Backup codes

6. Security Key

Post reply on HN