Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

101–110 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#101

Post by Shorel »

belorn wrote: post #19

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or s…

Any relationship with Godaddy sounds dirty.

They are basically imposing the worst registrar ever on customers, for this particular scenario.

Re: When did POP and IMAP become a “legacy protocol?”

#102

Post by tadfisher »

Wowfunhappy wrote: post #73
okasaki wrote: post #23

> I do have to wonder how long until Google decides that only certain clients can connect with Gmail? Already the case on mobile: > If you use the Play store or GitHub version of FairEmail, you can use the quick setup wizard to easily setup a Gmail account and identity. The Gmail quick setup wizard is not available for third party builds, like the F-Droid build because Google approved the use of OAuth for official bu…

Can you get around this by setting an App Specific password on your Google account?

That functionality was removed in favor of OAuth.

I'm not sure M66B needs to get approval for the other builds, though, because the access is gated at the cloud API, not though client libraries. You can use Play Services to grant OAuth tokens, or you can use the boring old Google API client libraries, or roll your own; you just need to add the other signing key fingerprints and application IDs to the credential in the project's cloud console.

I could easily be mistaken, but there are numerous open-source projects acting as mail clients through the GMail API, Google has granted them access, and they don't have to use a closed-source client to do it. Most of them don't even target Android.

Re: When did POP and IMAP become a “legacy protocol?”

#103

Post by Meph504 »

johnklos wrote: post #37
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

That letter isn't from microsoft though, I manage several tenants, and none of our end users or admin got that letter.

specifically what is missing, is that email using basic auth won't disconnected OCT 1st because of the tons and tons of machine that do things like email faxes, and scans that do not support modern authentication.

This looks like whoever "enterprise services" is, they wrote a brief message that wasn't very accurate.

Re: When did POP and IMAP become a “legacy protocol?”

#104

Post by verisimilitudes »

bitwize wrote: post #98
bayindirh wrote: post #28

Earlier quoted context omitted.

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. No, no, no, no, no, no, no. ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly exp…

Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.

Re: When did POP and IMAP become a “legacy protocol?”

#105

Post by _emacsomancer_ »

Wowfunhappy wrote: post #73
okasaki wrote: post #23

> I do have to wonder how long until Google decides that only certain clients can connect with Gmail? Already the case on mobile: > If you use the Play store or GitHub version of FairEmail, you can use the quick setup wizard to easily setup a Gmail account and identity. The Gmail quick setup wizard is not available for third party builds, like the F-Droid build because Google approved the use of OAuth for official bu…

Can you get around this by setting an App Specific password on your Google account?

For Gmail, yes. For Outlook, no.

Re: When did POP and IMAP become a “legacy protocol?”

#106

Post by tadfisher »

_emacsomancer_ wrote: post #105
Wowfunhappy wrote: post #73

Earlier quoted context omitted.

Can you get around this by setting an App Specific password on your Google account?

For Gmail, yes. For Outlook, no.

That was removed in May of this year in favor of the SASL XOAUTH2 mechanism.

Re: When did POP and IMAP become a “legacy protocol?”

#107

Post by amaccuish »

rendaw wrote: post #96
johnklos wrote: post #37

Earlier quoted context omitted.

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email. Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm n…

Microsoft doesn't by default block the embedded Thunderbird browser. An admin can however enable that setting.

Re: When did POP and IMAP become a “legacy protocol?”

#108

Post by stiray »

Gigachad wrote: post #80
gkbrk wrote: post #50

Earlier quoted context omitted.

If Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted.

But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

The important is that ISPs are evil and untrusted. facepalm

Re: When did POP and IMAP become a “legacy protocol?”

#109

Post by vlovich123 »

bayindirh wrote: post #59
vlovich123 wrote: post #54

Earlier quoted context omitted.

Afaik not actually possible in practice. Browsers these days will a) remember valid certs for a domain b) remember that a domain is HTTPS (no downgrades) c) sniff certificates based on crowdsourcing.

Maybe this is why it reduced and stopped over the years. I'm not as knowledgeable in contemporary HTTPS and its capabilities, probably. Because I'm pretty sure that happened.

Yeah. I hope you realize though why there’s a stern castigation, on a particularly techy and security conscious forum, of using HTTP instead of HTTPS. People here both remember the problems and what’s been done to combat them. It’s discomforting to see backwards progress when so much has been done. Security isn’t purely a technical problem. It’s an educational one too.

Re: When did POP and IMAP become a “legacy protocol?”

#110

Post by Gigachad »

stiray wrote: post #108
Gigachad wrote: post #80

Earlier quoted context omitted.

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted. But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,... The important is that ISPs are evil and untrusted. facepalm

ISPs are the most blatantly scummy of the lot. They log everything, usually by government requirements, sell it to anyone, give it to the government without a warrant, inject adverts and js in to unprotected requests, and all kinds of malicious things.

They are easily eliminated from the picture. One less party with access to your data the better. There is really _no_ good argument for not having HTTPS on any site unless its some very rare case like an intranet site.

Post reply on HN