Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

141–150 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#141

Post by shakna »

yardstick wrote: post #132
shakna wrote: post #91

Earlier quoted context omitted.

> Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right? All Gemini is signed. [0] It's mandatory. That's why the parent piped through openssl to connect. For example, the page that we're looking at is signed. [1] (Using a bridge to show the certificate, but you can verify it yourself, as well.) [0] https://gemini.circumlunar.space/docs/speci…

Is that signature from the original author, or from an intermediary/Gemini proxy?

The authour. You can see their domain in the email that makes the signature.

> CA/emailAddress=ca@conman.org

> CN=gemini.conman.org/emailAddress=sean@conman.org

Re: When did POP and IMAP become a “legacy protocol?”

#142

Post by Avamander »

trasz wrote: post #120
ltratt wrote: post #117

For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are: Email OAuth 2.0 Proxy https://github.com/simonrob/email-oauth2-proxy >; mailctl https://github.com/pdobsan/mailctl >; mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mu…

Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.

God forbid you actually have functioning token rotation and revocation alongside 2FA. So insecure. /s

Re: When did POP and IMAP become a “legacy protocol?”

#143

Post by Avamander »

tsimionescu wrote: post #127
foverzar wrote: post #111

Earlier quoted context omitted.

It could, if the CAs were globally distributed. Unfortunately currently they are all under the US influence.

It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.

Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.

Re: When did POP and IMAP become a “legacy protocol?”

#144

Post by gernb »

yardstick wrote: post #129
Yeahsureok wrote: post #123

Earlier quoted context omitted.

My ISP injects ads into http sites often. Now just imagine what this corrupt third world government here can do. Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is. If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)

I think the more important question is why are you still supporting this ISP by being their customer?

could be on airport wifi, store wifi, cafe wifi, hotel wifi, etc...

https prevents them injecting shit

Re: When did POP and IMAP become a “legacy protocol?”

#145

Post by msh »

stiray wrote: post #108
Gigachad wrote: post #80

Earlier quoted context omitted.

ISPs are evil and untrusted. That’s just a fact. The solution is to not allow them to see or modify anything.

Other IT corporations are also evil and untrusted. But no one cares if they can look into all your mails and documents (Microsoft, Google), track you all over the web, see where you are going, which flight you are taking,... The important is that ISPs are evil and untrusted. facepalm

Some places the ISP's are monopolies, or duopolies. Even with current tech giants you have many options.

Re: When did POP and IMAP become a “legacy protocol?”

#146

Post by ZiiS »

bayindirh wrote: post #28
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…

Expressing a public opinion on how communication systems should implement their authentication needs at least some security, IMHO.

Re: When did POP and IMAP become a “legacy protocol?”

#147

Post by magicalhippo »

trasz wrote: post #120
ltratt wrote: post #117

For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are: Email OAuth 2.0 Proxy https://github.com/simonrob/email-oauth2-proxy >; mailctl https://github.com/pdobsan/mailctl >; mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mu…

Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.

Could you expand on that? How is OAuth 2.0 fundamentally insecure in this setting?

Re: When did POP and IMAP become a “legacy protocol?”

#148

Post by magicalhippo »

jeroenhd wrote: post #36
advisedwang wrote: post #4

Earlier quoted context omitted.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already…

> What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key?

Our application send mails on behalf of our customers. This is done in an on-prem background service running on one of their servers wherever that might be.

So, anything interactive is a no-go. And installing a physical USB key is probably a no-go for most customers, especially those who have their servers hosted by a provider.

Re: When did POP and IMAP become a “legacy protocol?”

#149

Post by magicalhippo »

amaccuish wrote: post #107
rendaw wrote: post #96

Earlier quoted context omitted.

This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email. Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm n…

Microsoft doesn't by default block the embedded Thunderbird browser. An admin can however enable that setting.

Guess it would be nice with a fall-back option in Thunderbird to use the system browser.

Re: When did POP and IMAP become a “legacy protocol?”

#150

Post by belorn »

Semaphor wrote: post #112
belorn wrote: post #19

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or s…

> and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar I guess that’s US only? With 5 employees we are a pretty small company and this is not the case for us.

https://support.microsoft.com/en-us/office/get-a-personalize...

"At the moment, we only support connecting domains managed by GoDaddy with Outlook.com"

In my market those accounts were also marketed towards small companies, with only Microsoft 365 Business tiers and above having the feature of allowing other providers than godaddy as domain registrars.

You can also read about it here in the press release: https://news.microsoft.com/2014/01/13/microsoft-and-godaddy-...

"Announced on Monday a long-term strategic partnership to offer Office 365 as GoDaddy’s exclusive core business-class email and productivity service to its small-business customers".

Microsoft do however change their tiers and plans regularly, and whom they target them to. In my job, seeing customers being unable to switch to other registrars has been a fairly common occurrence. Microsoft 365 Business plans should be fine to my knowledge, through I recall Microsoft 365 email essential for small business wasn't, which has been rebranded to Microsoft 365 Business basic, but I don't know if that mean it is a Microsoft 365 Business plan now or still the more limited "personal" plan. A customer who bought essential in the past and now is on basic might be able to leave godaddy, but I don't know and it might depend on software versions, updates and who know what.

Post reply on HN