It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries to connect to the mail server. However this connection occurs before you can set the SSL option. This happens twice, once for setting the incoming server and then for the outgoing server. This feels wrong, but it may be secure.
My question is whether this connection to the mail server using the mail user name and password is secure? Are the username and password transmitted securely?
If so what is the security on this server connection?
Would it depend on the capabilities of the mail server you are trying to setup, SSL, IMAP, SMTP etc?
The connection appears to be using the username and password since when I change either of them the connection fails.
I had a look at using tcpdump but it is not that easy to figure out even using the information on www.tcpdump.org. Wireshark also has a steep learning curve.
I ask this because I have experienced once every few weeks the disappearance of my mail passwords in Apple-mail requiring me to set them up again. This has made me more worried than usual about system security. In particular the way the connection appears to be made before you can set the SSL option.
Someone on an other forum described some tests which I have carried out. tcpdump -i ethX -s0 -w /path/filename.pcap Replace ethX with your interface (probably eth0 but you can find out with either ifconfig or ip addr) and obviously, /path/filename.pcap = path and filename. Then use Wireshark to Search the output using Edit -> "Find packets" and select "Packet bytes." and search type "String".
For the tests I did I couldn't find the password. Though the user name is visible which may be different to the email address. Not sure what security is used on the password, but at least it seems reasonably secure.
Though I see here https://itservices.stanford.edu/service/emailcalendar/email/config/osx_imap_kerb they recommend leaving the password field blank until the authentication method is set and SSL is selected.