Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

121–130 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#121

Post by trasz »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

>It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol.

Problem is, it is being replaced by solution that decreases security.

Re: When did POP and IMAP become a “legacy protocol?”

#122

Post by staticassertion »

stiray wrote: post #108
Gigachad wrote: post #80

Earlier quoted context omitted.

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted. But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,... The important is that ISPs are evil and untrusted. facepalm

> But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,...

I don't think I go a single day without reading posts complaining about exactly that, so obviously people do care.

Re: When did POP and IMAP become a “legacy protocol?”

#123

Post by Yeahsureok »

bayindirh wrote: post #28
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

My ISP injects ads into http sites often.

Now just imagine what this corrupt third world government here can do.

Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is.

If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)

Re: When did POP and IMAP become a “legacy protocol?”

#124

Post by tsimionescu »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

Knowing that I'm watching YouTube is one thing, knowing what YouTube video I'm watching is a completely different problem.

Edit also: even with DNS over HTTPS, a lot of the Internet uses SNI for TLS, so anyone snooping can anyway see what hostname you're visiting (not to mention, IPs are not significantly more private than host names, and those will always be public unless you're using ToR or something similar).

Re: When did POP and IMAP become a “legacy protocol?”

#125

Post by edg5000 »

a-dub wrote: post #8

you have to jump through hoops to do basic auth (even over SSL) for IMAP/pop with gmail as well. (this has been true for some years now) on one level, it's sad to see the open protocols go... on the other, google passwords are a big deal.

What hoops are you referring to? Regarding the password, Google requires you to use an App Password, e.g. a password used solely for POP/IMAP, separate form you Google password. I suppose setting up POP/IMAP nowadays would involve: - Enable POP/IMAP in GMail settings - Set an App Password - Enter email address, full name and App Password in Thunderbird first-time use wizard.

I suppose this can be a pain if you are not aware of these 2 settings, for newcomers they would likely need a tutorial. However this setup is really a one-time process.

Re: When did POP and IMAP become a “legacy protocol?”

#126

Post by tsimionescu »

josephcsible wrote: post #86
denkmoon wrote: post #82

Earlier quoted context omitted.

When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.

If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?

Unfortunately, people are now often fighting with their own devices for control over which 3rd party services they access. This sometimes means that you have reasons to MITM or block traffic your own devices generate if you want to control aspects of who you actually send data to, or what data you actually send.

Re: When did POP and IMAP become a “legacy protocol?”

#127

Post by tsimionescu »

foverzar wrote: post #111
verisimilitudes wrote: post #104

Earlier quoted context omitted.

Hey, fellow genius on Hacker News, do note that TLS doesn't protect against state actors, because they can very easily manipulate certificate authorities, and a malicious certificate authority completely removes most protections TLS supposedly provides.

It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.

It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.

Re: When did POP and IMAP become a “legacy protocol?”

#128

Post by wizofaus »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

Didn't know about JMAP - had been looking recently for open JSON-API-over-HTTP protocols, good to know.

Re: When did POP and IMAP become a “legacy protocol?”

#129

Post by yardstick »

Yeahsureok wrote: post #123
bayindirh wrote: post #28

Earlier quoted context omitted.

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

My ISP injects ads into http sites often. Now just imagine what this corrupt third world government here can do. Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is. If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)

I think the more important question is why are you still supporting this ISP by being their customer?

Re: When did POP and IMAP become a “legacy protocol?”

#130

Post by yardstick »

bitwize wrote: post #98
bayindirh wrote: post #28

Earlier quoted context omitted.

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. No, no, no, no, no, no, no. ALL Web traffic should be https (or http/2 or /3). If you connect to a site that uses insecure http, ANY link between you and that site can easily snoop on traffic and even inject different content. You CANNOT be sure that the content you see is what was originally served by the server, and you can certainly exp…

Have you considered disabling non-https in your browser, and blocked outbound port 80 on your home router?
Post reply on HN