TLDR: when IMAP didn't standardize push, and when people started to use HTTP for everything.
JMAP is the current hotness.
When did POP and IMAP become a “legacy protocol?”
151–160 of 222 posts
Re: When did POP and IMAP become a “legacy protocol?”
#152I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…
What downsides POP3 has? Looks like a terribly simple protocol and does the job of moving messages from one place to another quite well for me.
Having to use anything more complex would be a downgrade. More complex to setup on server and client side, with more options and more problems to take care of.
I like to use the simplest tool for the job.
Re: When did POP and IMAP become a “legacy protocol?”
#153Earlier quoted context omitted.
It's enough to compromise one CA for TLS to be entirely defeated - any CA can sign a certificate for any site, and TLS implementations will accept it. The only defense is pinned certificates, but that comes with its own problems.
Certificate Transparency is enforced, so it'd be quite easy to detect that compromise by now.
Sure, but still somewhat after the fact.
Re: When did POP and IMAP become a “legacy protocol?”
#154I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…
What downsides POP3 has? Looks like a terribly simple protocol and does the job of moving messages from one place to another quite well for me. Having to use anything more complex would be a downgrade. More complex to setup on server and client side, with more options and more problems to take care of. I like to use the simplest tool for the job.
> What downsides POP3 has? Looks like a terribly simple protocol
Exactly that, it's terribly simple. People have multiple devices, that alone makes POP3 an annoying protocol to use.
Re: When did POP and IMAP become a “legacy protocol?”
#155Earlier quoted context omitted.
> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.
Um what? Nothing in IMAP prevents you from doing the same. Just because most client implementations assume you want to keep your mail on the server by default, does not mean the protocol doesn’t account for the other possibility. And to be fair, configuring most clients to retrieve and then delete, or keep a local copy in addition to the server one, is not difficult at all - these options are not hidden or anything.
POP3 is exceedingly simple protocol compared to IMAP. I'd rather use the simplest tool for the job.
In case the password leaks, attacker can only fetch new messages over POP3, and not plant them or fetch the entire archive from the server. (yeah, I can fetch and delete over IMAP too, but then what's the point of all the extra unused complexity of IMAP, it's just an extra risk)
Re: When did POP and IMAP become a “legacy protocol?”
#156I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…
> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…
> I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly.
That could be done using IMAP as well. The overhead for that use case seems quite small. However it is just one protocol to support. And I haverun into a bunch of non-techy users with problems like "if i read my mails on my desktop I can't access them on my phone anymore, so I always use the phone"-like problems, which tells me their mail client on desktop likely uses POP3. By not offering POP3 you are removing that class of support problems with very little downside.
Re: When did POP and IMAP become a “legacy protocol?”
#157I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…
Shaming people for not having HTTPS on their blog is not a great look. :/
Fun fact: HTTPS is implicitly required by the GDPR because the user agent metadata is considered PII and websites are required to implement best current practices, which includes HTTPS. There is no exemption for (public) personal websites as they're still providing a publicly accessible service and processing PII to do so.
The same goes for a privacy policy for that matter.
Re: When did POP and IMAP become a “legacy protocol?”
#158Earlier quoted context omitted.
Can you get around this by setting an App Specific password on your Google account?
That functionality was removed in favor of OAuth. I'm not sure M66B needs to get approval for the other builds, though, because the access is gated at the cloud API, not though client libraries. You can use Play Services to grant OAuth tokens, or you can use the boring old Google API client libraries, or roll your own; you just need to add the other signing key fingerprints and application IDs to the credential in th…
> That functionality was removed in favor of OAuth.
Huh?
I'm using it right now in order to use Gmail in an email client that doesn't support OAuth.
Re: When did POP and IMAP become a “legacy protocol?”
#159Earlier quoted context omitted.
Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.
God forbid you actually have functioning token rotation and revocation alongside 2FA. So insecure. /s
What does oauth have to tho with authentication (let alone 2FA)?
Re: When did POP and IMAP become a “legacy protocol?”
#160Earlier quoted context omitted.
When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.
If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?
Not just block. I run split-horizon DNS at home for a few of my services. Without being able to control the DNS for devices on my LAN, they can't use those services.
Now you might argue that's a bit silly, but it is a use-case.