Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

131–140 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#131

Post by jonathantf2 »

b215826 wrote: post #85
jonathantf2 wrote: post #15

You can still enable these protocols per user - Microsoft are disabling these and Basic Authentication by default as most users don’t use them and it’s the primary vector for sending emails from compromised accounts. Any Microsoft tenant I set up or manage already has policies to block anything but the Outlook desktop or mobile clients with MFA on every account.

> You can still enable these protocols per user From what I understand, Microsoft will disable basic authentication starting January 2023, and the next few months are sort of a "grace period" to migrate to Microsoft's new authentication protocol [1]: > On September 1, 2022, we announced there will be one final opportunity to postpone this change. Tenants will be allowed to re-enable a protocol once between October 1,…

I'm referring to IMAP/POP, you'll be able to use these with OAuth instead of basic auth. I imagine their stats show that 99 percent of users use Outlook of some sort so to up security they turned basic auth off.

Re: When did POP and IMAP become a “legacy protocol?”

#132

Post by yardstick »

shakna wrote: post #91
shadowgovt wrote: post #38

Earlier quoted context omitted.

Do either of these address the underlying problem that without https there's no guarantee that the blog content hasn't been modified in transit? Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?

> Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right? All Gemini is signed. [0] It's mandatory. That's why the parent piped through openssl to connect. For example, the page that we're looking at is signed. [1] (Using a bridge to show the certificate, but you can verify it yourself, as well.) [0] https://gemini.circumlunar.space/docs/speci…

Is that signature from the original author, or from an intermediary/Gemini proxy?

Re: When did POP and IMAP become a “legacy protocol?”

#133

Post by sgtnoodle »

intelVISA wrote: post #116
sgtnoodle wrote: post #34

Earlier quoted context omitted.

I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitel…

> but I am a highly experienced software engineer with a deep understanding of network protocols Thank you for your service

Lol, thanks. I rarely work on stuff exposed to the Internet. I've implemented multiple bare metal IP stacks from scratch, including Ethernet, DHCP, ARP, ICMP, and UDP. I've run real-time safety critical packets over TCP links. I've tunneled IP traffic through the international space station. I've done unforgivable things with iptables and awk.

The funny thing is that IPv6 short-circuits my brain. Why do I have four addresses, and where did they come from? Why isn't there a link-local address for loopback and wireguard?

Re: When did POP and IMAP become a “legacy protocol?”

#135

Post by nottorp »

advisedwang wrote: post #4
ljlds3da wrote: post #2

Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

Whatever their reasoning, it means i have to have an email client and a browser to log in. Can't say I like that.

Re: When did POP and IMAP become a “legacy protocol?”

#136

Post by murderfs »

Ignoring authentication, POP and IMAP truly are legacy protocols in the sense that they were designed in an era where bandwidth, not latency was the major constraint for accessing email. It made sense to send a notification that the size of your inbox changed, and let the client decide whether or not to fetch your emails. Since then, internet connections have gotten tens of thousands of times more bandwidth, but the speed of light hasn't improved correspondingly.

Re: When did POP and IMAP become a “legacy protocol?”

#138

Post by qwerty456127 »

murderfs wrote: post #136

Ignoring authentication, POP and IMAP truly are legacy protocols in the sense that they were designed in an era where bandwidth, not latency was the major constraint for accessing email. It made sense to send a notification that the size of your inbox changed, and let the client decide whether or not to fetch your emails. Since then, internet connections have gotten tens of thousands of times more bandwidth, but the…

Now or then, whatever the bandwidth or latency, why couldn't we just use a REST web service which would let a client access whatever the parameter incl. mailbox size, list the messages, read the messages in form of JSON/XML arrays of metadata + message bodies in Markdown format?

Re: When did POP and IMAP become a “legacy protocol?”

#139

Post by stemc43 »

a-dub wrote: post #8

you have to jump through hoops to do basic auth (even over SSL) for IMAP/pop with gmail as well. (this has been true for some years now) on one level, it's sad to see the open protocols go... on the other, google passwords are a big deal.

> google passwords at my work - they are disabled in our enterprise account - no alternative to oauth. I think they may even be disabled by default in general in gmail.

Re: When did POP and IMAP become a “legacy protocol?”

#140

Post by HelloNurse »

qwerty456127 wrote: post #138
murderfs wrote: post #136

Ignoring authentication, POP and IMAP truly are legacy protocols in the sense that they were designed in an era where bandwidth, not latency was the major constraint for accessing email. It made sense to send a notification that the size of your inbox changed, and let the client decide whether or not to fetch your emails. Since then, internet connections have gotten tens of thousands of times more bandwidth, but the…

Now or then, whatever the bandwidth or latency, why couldn't we just use a REST web service which would let a client access whatever the parameter incl. mailbox size, list the messages, read the messages in form of JSON/XML arrays of metadata + message bodies in Markdown format?

Because without a standard protocol they would be N underspecified proprietary variants: the Gmail web service, the Office 365 web service, the Office 365 from last year web service...

All of them with complicated authentication requirements, idiosyncratic URL construction, and other difficulties. You would throw away the baby and keep the bathwater.

Post reply on HN