Earlier quoted context omitted.
And enterprises hate this.
It does increase the cost of tech support.
Perhaps, but I feel the real reason is their security team tells them they can't control it so they should get rid of it.
When did POP and IMAP become a “legacy protocol?”
81–90 of 222 posts
Re: When did POP and IMAP become a “legacy protocol?”
#82Re: When did POP and IMAP become a “legacy protocol?”
#83[deleted]
Re: When did POP and IMAP become a “legacy protocol?”
#84Re: When did POP and IMAP become a “legacy protocol?”
#85You can still enable these protocols per user - Microsoft are disabling these and Basic Authentication by default as most users don’t use them and it’s the primary vector for sending emails from compromised accounts. Any Microsoft tenant I set up or manage already has policies to block anything but the Outlook desktop or mobile clients with MFA on every account.
> You can still enable these protocols per user
From what I understand, Microsoft will disable basic authentication starting January 2023, and the next few months are sort of a "grace period" to migrate to Microsoft's new authentication protocol [1]:
> On September 1, 2022, we announced there will be one final opportunity to postpone this change. Tenants will be allowed to re-enable a protocol once between October 1, 2022 and December 31, 2022. Any protocol exceptions or re-enabled protocols will be turned off early in January 2023, with no possibility of further use. See the full announcement at Basic Authentication Deprecation in Exchange Online – September 2022 Update.
> Microsoft are disabling these and Basic Authentication as most users don’t use them and it’s the primary vector for sending emails from compromised accounts
Even if most users don't use basic auth, I don't see why Microsoft has to disable it altogether. For people who want to keep using legacy clients, it's not too hard to force the usage of application-specific passwords.
[1] https://learn.microsoft.com/en-us/exchange/clients-and-mobil...
Re: When did POP and IMAP become a “legacy protocol?”
#86Earlier quoted context omitted.
How does DoH make DNS any more centralized than DoT does?
When Google embed their DNS and their certificate into every Google product you have to use, you can't effectively block it.
If your goal isn't to censor or surveil other people, then why do you need to block Google's DNS rather than just not using it yourself?
Re: When did POP and IMAP become a “legacy protocol?”
#87Earlier quoted context omitted.
Comcast injects data into plain http pages, altering them when they see fit (they put in a datacap warning into the text of the page).
If Comcast is doing something wrong, why does everyone else need to do something about it? If Comcast stops routing packets on port 433, should everyone else stop using it as well?
This is like saying we shouldn't use encryption just because there are bad guys stealing our data... just because hackers do something wrong, why does everyone else need to do something about it?
We have to do a lot of things because bad guys do bad things. What is the alternative? Pretend they don't exist?
Re: When did POP and IMAP become a “legacy protocol?”
#88I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, i…
> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide…
> If you're not doing anything requiring security, you don't need HTTPS, IMHO.
There have been documented attacks of people getting hacked because they were browsing the web with plain-HTTP and someone injected malicious pages mid-stream; see "Quantum Insert":
* https://www.infoworld.com/article/2609621/uk-spy-agency-uses...
* https://www.wired.com/2015/04/researchers-uncover-method-det...
Re: When did POP and IMAP become a “legacy protocol?”
#89Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.
They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/…
Yeah, but they use SMS 2FA which is not secure.
Re: When did POP and IMAP become a “legacy protocol?”
#90Earlier quoted context omitted.
The same people who'd claim http is a bad look would also tell you to pipe curl to bash with sudo.
That's a weird claim to make; what makes you think that? Though I suppose https is a prerequisite for that pipe to maybe be safe. Piping curl to bash varies from stupid to just fine depending on context.
Just look around at lots of how-tos, particularly ones that tell you how to generate and set up certificates.