Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

171–180 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#171

Post by denton-scratch »

Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

> It's basic auth that's getting deprecated

I missed that, because I don't jump down every linked rabbithole. Thanks.

Basic auth shouldn't be used for anything; I'm surprised it isn't already deprecated to hell and back. The letter says that Microsoft intends to deprecate IMAP and POP because some people use them with Basic auth. That doesn't make sense.

Re: When did POP and IMAP become a “legacy protocol?”

#172

Post by denton-scratch »

bayindirh wrote: post #41
cortesoft wrote: post #35

Earlier quoted context omitted.

> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.

Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.

> Unless you use DNS over HTTPS

It really isn't hard to set up an unbound resolver.

Re: When did POP and IMAP become a “legacy protocol?”

#173

Post by denton-scratch »

rexreed wrote: post #166
johannes1234321 wrote: post #156

Earlier quoted context omitted.

> I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. That could be done using IMAP as well. The overhead for that use case seems quite small. However it is just one protocol to support. And I haverun into a bunch of non-techy users with problems like "if i read my mails on my desktop I can't access them on my phon…

In what way can you configure IMAP to not leave messages on the server and yet still give multiple clients access to that email?

If you use POP (and allow it to delete downloaded messages from the server), you still can't access your mail from multiple clients.

Re: When did POP and IMAP become a “legacy protocol?”

#174

Post by denton-scratch »

jonathantf2 wrote: post #131
b215826 wrote: post #85

Earlier quoted context omitted.

> You can still enable these protocols per user From what I understand, Microsoft will disable basic authentication starting January 2023, and the next few months are sort of a "grace period" to migrate to Microsoft's new authentication protocol [1]: > On September 1, 2022, we announced there will be one final opportunity to postpone this change. Tenants will be allowed to re-enable a protocol once between October 1,…

I'm referring to IMAP/POP, you'll be able to use these with OAuth instead of basic auth. I imagine their stats show that 99 percent of users use Outlook of some sort so to up security they turned basic auth off.

So Microsoft want you to switch from (awful) Basic Auth to a Microsoft-modified version of OAuth, is that it?

I don't use Microsoft mail services, except as SMTP destinations. Does Outlook not support Digest Auth? Digest Auth certainly isn't perfect (I seem to remember that it requires an extra roundtrip), but it's not a security disaster like Basic Auth.

My main problem with OAuth is that it's hard for users to understand. If we expect users to use the internet securely, then they need to be able to know when that's not what they're doing, and I don't know any ordinary Joe that I could explain OAuth to. Hell, I implemented OAuth once, and now I can't remember how it works. It doesn't help that OAuth is a moving target.

Re: When did POP and IMAP become a “legacy protocol?”

#175

Post by okasaki »

Wowfunhappy wrote: post #158
tadfisher wrote: post #102

Earlier quoted context omitted.

That functionality was removed in favor of OAuth. I'm not sure M66B needs to get approval for the other builds, though, because the access is gated at the cloud API, not though client libraries. You can use Play Services to grant OAuth tokens, or you can use the boring old Google API client libraries, or roll your own; you just need to add the other signing key fingerprints and application IDs to the credential in th…

> That functionality was removed in favor of OAuth. Huh? I'm using it right now in order to use Gmail in an email client that doesn't support OAuth.

You're right, that works.

The only blocker is that app passwords are only available if you turn on 2fa (even though the functions aren't related.)

Re: When did POP and IMAP become a “legacy protocol?”

#176

Post by tpoacher »

johnklos wrote: post #37
Avamander wrote: post #3

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

It gets worse.

"We won't support clients that dont support microsoft supported practices" is a very short stone's throw away from "we won't support non-microsoft clients", as I've come to discover at my university, where I had to ask for permission to use an email client just for oauth to work.

Which is yet to be granted after 2 months (and if granted, will be granted site-wide ... i.e. unlikely unless there is a large demand for non-microsoft clients)

Re: When did POP and IMAP become a “legacy protocol?”

#177

Post by trasz »

magicalhippo wrote: post #165
megous wrote: post #159

Earlier quoted context omitted.

What does oauth have to tho with authentication (let alone 2FA)?

Besides being used for authentication? https://learn.microsoft.com/en-us/exchange/client-developer/...

You can use 2FA with static password authentication. Remember the “password” here only means “character string”, it can easily carry an OTP.

Re: When did POP and IMAP become a “legacy protocol?”

#178

Post by trasz »

magicalhippo wrote: post #147
trasz wrote: post #120

Earlier quoted context omitted.

Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.

Could you expand on that? How is OAuth 2.0 fundamentally insecure in this setting?

It makes it necessary to use a browser to obtain the token. That browser is a huge attack surface. With web, it doesn’t matter, since you need to be using it anyway, but for mail it’s just additional cruft.

Re: When did POP and IMAP become a “legacy protocol?”

#179

Post by magicalhippo »

trasz wrote: post #177
magicalhippo wrote: post #165

Earlier quoted context omitted.

Besides being used for authentication? https://learn.microsoft.com/en-us/exchange/client-developer/...

You can use 2FA with static password authentication. Remember the “password” here only means “character string”, it can easily carry an OTP.

Right, just as with XOAUTH2, the "password" sent to the server is actually the (encoded) OAuth token.

Re: When did POP and IMAP become a “legacy protocol?”

#180

Post by trasz »

magicalhippo wrote: post #179
trasz wrote: post #177

Earlier quoted context omitted.

You can use 2FA with static password authentication. Remember the “password” here only means “character string”, it can easily carry an OTP.

Right, just as with XOAUTH2, the "password" sent to the server is actually the (encoded) OAuth token.

So what does it improve then, that would justify the incompatibility and added technological debt (dependencies)?
Post reply on HN