Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

91–100 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#91

Post by shakna »

shadowgovt wrote: post #38
1vuio0pswjnm7 wrote: post #31

Earlier quoted context omitted.

"Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost." This blog can be read over TLS using gemini://. printf 'gemini://gemini.conman.org/boston/2022/09/22.1\r\n' \ |openssl s_client -connect 71.19.142.20:1965 -ign_eof Also https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...

Do either of these address the underlying problem that without https there's no guarantee that the blog content hasn't been modified in transit? Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?

> Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?

All Gemini is signed. [0] It's mandatory. That's why the parent piped through openssl to connect.

For example, the page that we're looking at is signed. [1] (Using a bridge to show the certificate, but you can verify it yourself, as well.)

[0] https://gemini.circumlunar.space/docs/specification.html

[1] https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...

Re: When did POP and IMAP become a “legacy protocol?”

#92

Post by denkmoon »

josephcsible wrote: post #86
denkmoon wrote: post #82

Earlier quoted context omitted.

When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.

If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?

Chromecast will use Google DNS and there is nothing you can do about it on the device. Guarantee this will happen to Chrome eventually.

Re: When did POP and IMAP become a “legacy protocol?”

#93

Post by [deleted] »

cortesoft wrote: post #35
bayindirh wrote: post #28

Earlier quoted context omitted.

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

[deleted]

Re: When did POP and IMAP become a “legacy protocol?”

#94

Post by deaddodo »

pvorb wrote: post #29
deaddodo wrote: post #20

Earlier quoted context omitted.

So does IMAP? Most clients only cache headers because it’s faster and most devices are always-connected; but you can certainly locally download the entirety of your IMAP contents. Considering you have to download the entirety of the mail contents to read it anyways, I have no idea what makes you think this is an impossibility.

Yeah, but typically the difference is that you can't see IMAP as a backup. Whereas with POP3 (and not having your client set up to automatically delete emails on the server) you can. With IMAP, when an email gets deleted by some client, other clients will also delete their local copies of that email. That won't happen with POP3. But I haven't read either of the two protocols, so I'm not sure whether that's something…

> With IMAP, when an email gets deleted by some client, other clients will also delete their local copies of that email. That won't happen with POP3.

This is not an IMAP feature, this is a client feature. There are plenty of clients that don’t sync deletes, if you don’t want to.

Or, just don’t delete your emails? If you delete a POP email from your client, it’s also gone for good.

Re: When did POP and IMAP become a “legacy protocol?”

#95

Post by 1vuio0pswjnm7 »

josephcsible wrote: post #65
cortesoft wrote: post #44

Earlier quoted context omitted.

They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.

And if you're using TLS ECH, then they wouldn't even know the host name.

The website operator has to use it, too. Many HTTP servers still do not support TLS1.3 let alone ECH (Draft 13). ECH is still experimental. Cloudflare disabled their ESNI trial a while back (ESNI worked great for me outside the browser), so unless they have now got ECH working (I still have not seen any announcement), currently there are even fewer sites offering encrypted SNI. You could probably count them on one hand. And Firefox (nightly), Chromium (105+) and Brave (nightly) are probably the only browsers that would support ECH and it is not enabled by default. I would be pleased to learn I am wrong here, because I would love to again start using sites that do not return requested pages unless a servername is sent.

Re: When did POP and IMAP become a “legacy protocol?”

#96

Post by rendaw »

johnklos wrote: post #37
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email.

Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm not going to use the webmail just for this account - set up a forwarding email and told everyone to use my new address).

Re: When did POP and IMAP become a “legacy protocol?”

#98

Post by bitwize »

bayindirh wrote: post #28
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO.

No, no, no, no, no, no, no.

ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly expect that state actors will be noting that you viewed this content, and building a profile on you based on that information.

Re: When did POP and IMAP become a “legacy protocol?”

#99

Post by bitwize »

chowells wrote: post #9
mattgreenrocks wrote: post #5

Earlier quoted context omitted.

Shaming people for not having HTTPS on their blog is not a great look. :/

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.

Re: When did POP and IMAP become a “legacy protocol?”

#100

Post by chowells »

bitwize wrote: post #99
chowells wrote: post #9

Earlier quoted context omitted.

I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.

Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.

I'm not sure you read what I wrote. At no point did I say to bathe, or in fact proffer any treatment at all for body odor. I merely pointed out that refusing to deal with it when you're in close quarters with a large number of people is antisocial. If somehow wallowing in mud treats it for someone, then that's what they should be doing. The problem is knowing how to solve it and refusing to do so.
Post reply on HN