Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

111–120 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#111

Post by foverzar »

verisimilitudes wrote: post #104
bitwize wrote: post #98

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. No, no, no, no, no, no, no. ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly exp…

Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.

It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.

Re: When did POP and IMAP become a “legacy protocol?”

#112

Post by Semaphor »

belorn wrote: post #19

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or s…

> and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar

I guess that’s US only? With 5 employees we are a pretty small company and this is not the case for us.

Re: When did POP and IMAP become a “legacy protocol?”

#113

Post by kevin_thibedeau »

rendaw wrote: post #96
johnklos wrote: post #37

Earlier quoted context omitted.

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email. Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm n…

So spoof the user agent.

Re: When did POP and IMAP become a “legacy protocol?”

#114

Post by Karellen »

0x457 wrote: post #61
jeroenhd wrote: post #36

Earlier quoted context omitted.

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already…

> What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that. GitHub alone has like 5 differe…

> Infrastructure to handle authentication on the web already exists.

Email does not run over the web, it runs over the internet. It uses a completely different set of protocols from the web, which were all invented at least 5 years before the first web protocol. Why should email clients be required to add HTTP support in order to make email work?

Maybe we should take heed of Zawinski's Law, and make all web browsers implement native email clients instead. Yeah, that's probably it. The Netscape Communicator/Mozilla Suite model should never have been dropped, and it was a mistake to separate Firefox and Thunderbird as separate projects!

/s

Re: When did POP and IMAP become a “legacy protocol?”

#115

Post by Semaphor »

advisedwang wrote: post #4
ljlds3da wrote: post #2

Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

> a) password doesn't support 2nd factor.

FWIW, there’s the hacky way reddit clients authenticate: "password:OTP" instead of just your normal password. Not that MS could do that, but I wanted to mention the option ;)

Re: When did POP and IMAP become a “legacy protocol?”

#116

Post by intelVISA »

sgtnoodle wrote: post #34
pvorb wrote: post #25

Earlier quoted context omitted.

You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.

I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitel…

> but I am a highly experienced software engineer with a deep understanding of network protocols

Thank you for your service

Re: When did POP and IMAP become a “legacy protocol?”

#117

Post by ltratt »

For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are:

Email OAuth 2.0 Proxy https://github.com/simonrob/email-oauth2-proxy>; mailctl https://github.com/pdobsan/mailctl>; mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_o...> (some suggestion that it might not always work these days?); pizauth https://github.com/ltratt/pizauth>; oauth-helper-office-365 https://github.com/ahrex/oauth-helper-office-365>. Disclaimer: I wrote pizauth and it's just about to move into the alpha stage.

Re: When did POP and IMAP become a “legacy protocol?”

#119

Post by slooonz »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

HTTPs not completely blinding traffic analyzer doesn’t make the partial blinding useless.

Re: When did POP and IMAP become a “legacy protocol?”

#120

Post by trasz »

ltratt wrote: post #117

For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are: Email OAuth 2.0 Proxy https://github.com/simonrob/email-oauth2-proxy >; mailctl https://github.com/pdobsan/mailctl >; mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mu…

Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.
Post reply on HN