Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When did POP and IMAP become a “legacy protocol?”

boston.conman.org

Post reply on HN
Print view View original

181–190 of 222 posts

Re: When did POP and IMAP become a “legacy protocol?”

#181

Post by magicalhippo »

trasz wrote: post #178
magicalhippo wrote: post #147

Earlier quoted context omitted.

Could you expand on that? How is OAuth 2.0 fundamentally insecure in this setting?

It makes it necessary to use a browser to obtain the token. That browser is a huge attack surface. With web, it doesn’t matter, since you need to be using it anyway, but for mail it’s just additional cruft.

That's just for certain flows, like the common authorization code flow. The client credentials flow does not require a browser, for example.

Not sure about Google, but Microsoft supports client credentials for IMAP/POP3[1], but not for SMTP yet. IIRC it was supposed to be rolled out this January but is still missing. Hopefully they can get that deployed ASAP.

[1]: https://learn.microsoft.com/en-us/exchange/client-developer/...

Re: When did POP and IMAP become a “legacy protocol?”

#182

Post by magicalhippo »

trasz wrote: post #180
magicalhippo wrote: post #179

Earlier quoted context omitted.

Right, just as with XOAUTH2, the "password" sent to the server is actually the (encoded) OAuth token.

So what does it improve then, that would justify the incompatibility and added technological debt (dependencies)?

Well the question I responded to was "What does oauth have to tho with authentication".

I fully agree with the move away from plain passwords in this case, given that it's no longer "just" the password to a mail account, but to much, much more.

Now while I think OAuth adds some features that can be useful in certain settings, I'll be inclined to agree that requiring OAuth isn't the best move.

However the alternatives would probably require a lot of extra work on Microsoft's behalf, like being able to set up device-specific passwords or similar.

So, given the need to move away from plain account passwords, I can understand why they wouldn't want to do that and just use what they already had.

Re: When did POP and IMAP become a “legacy protocol?”

#183

Post by magicalhippo »

jsnell wrote: post #70
0x457 wrote: post #61

Earlier quoted context omitted.

> What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that. GitHub alone has like 5 differe…

> Google has, I think, 3? There's at least: 1. SMS 2. TOTP 3. Google Prompt (on Android / iOS) 4. Offline security codes (distinct thing from TOTP, generated from Android settings) 5. Backup codes 6. Security Key

Do you have some documentation for this? All I could find[1] pointed to them only supporting OAuth, similar to Microsoft.

[1]: https://developers.google.com/gmail/imap/imap-smtp

Re: When did POP and IMAP become a “legacy protocol?”

#184

Post by ripdog »

yardstick wrote: post #129
Yeahsureok wrote: post #123

Earlier quoted context omitted.

My ISP injects ads into http sites often. Now just imagine what this corrupt third world government here can do. Of course its "not a problem" if you aren't a vulnerable person who dares go against the grain, but on the whole it is. If your site is not using tls then it's automatically blocked sorry, maybe I'm not your target audience regarding security blogs though :)

I think the more important question is why are you still supporting this ISP by being their customer?

In corporate hellscapes like the USA, there is often no choice in ISPs, either because other ISPs can't justify the infrastructure investment to set up in opposition to the incumbent, or because the incumbent has lobbied local government to make use of power poles/conduits exclusive to them.

Re: When did POP and IMAP become a “legacy protocol?”

#185

Post by advisedwang »

timbit42 wrote: post #89
advisedwang wrote: post #4

Earlier quoted context omitted.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

Yeah, but they use SMS 2FA which is not secure.

Google offers FIDO, and even has an "advance protection" program to enforce only FIDO as 2nd factor.

Re: When did POP and IMAP become a “legacy protocol?”

#186

Post by GoblinSlayer »

cortesoft wrote: post #75
bayindirh wrote: post #66

Earlier quoted context omitted.

Two things have happened in the past. Scenario a: 1. Navigate to https://www.example.com 2. Arrive at https://www.completelyunrelated-adsite.com while your address bar reads https://www.example.com They used to do this regardless of your DNS. They directly hijacked that stream/connection. Scenario b: 1. Navigate to https://www.example.com 2. Get https://www.example.com with an ad-banner on top. They happened rarely,…

Scenario A is impossible and has been impossible for as long as https has been a thing. The only way it would be possible is if you installed a root cert from your ISP onto your computer so that it would trust a cert issued by them. Otherwise, they would not have a valid cert for example.com and you would be presented with a cert error. This is literally the exact thing https was designed to prevent. It is and always…

It's possible if the connection goes through an http proxy.

Re: When did POP and IMAP become a “legacy protocol?”

#187

Post by orev »

saagarjha wrote: post #81
shadowgovt wrote: post #46

Earlier quoted context omitted.

It does increase the cost of tech support.

Perhaps, but I feel the real reason is their security team tells them they can't control it so they should get rid of it.

Yes, that’s exactly the reason. Enforcing security is an endless black hole of effort that will increases exponentially with every new thing you need to support. So yes, reducing the number of things that need to be evaluated isn’t just some security guy trying to control everyone, it’s a hard requirement just to be able to have security at all.

Re: When did POP and IMAP become a “legacy protocol?”

#189

Post by GoblinSlayer »

qwerty456127 wrote: post #167
HelloNurse wrote: post #140

Earlier quoted context omitted.

Because without a standard protocol they would be N underspecified proprietary variants: the Gmail web service, the Office 365 web service, the Office 365 from last year web service... All of them with complicated authentication requirements, idiosyncratic URL construction, and other difficulties. You would throw away the baby and keep the bathwater.

I meant a standardized REST protocol. Why does it have (or ever had) to be something obscure like SMTP/POP3/IMAP if it could be just REST (still standardized, name it whatever)?

IMAP is more efficient than REST.

Re: When did POP and IMAP become a “legacy protocol?”

#190

Post by GoblinSlayer »

jeroenhd wrote: post #36
advisedwang wrote: post #4

Earlier quoted context omitted.

They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…

a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already…

Client certificate authentication can be done with any TLS, at least it already was in TLS 1.0 published in January 1999, even before SNI.
Post reply on HN