I'm making a few assumptions about basic email security, and I want to confirm or clarify some of these points to make sure I understand the big picture. Please correct me where I'm mistaken:
The answer to this question gives some insight, but doesn't cover all I'm looking for.
This is all assuming a traditional email service, accessed using a desktop or mobile client, over POP or IMAP, and SMTP (ignoring webmail).
Suppose I'm retrieving messages - my client app passes my username and password to the POP server, which authenticates me, and sends back the messages. If I'm not using SSL/TLS, then the entire conversation, including the message and credentials, is in plaintext. And anyone watching the network traffic can intercept the entire thing. And if I am using SSL, then the entire conversation is safe, even over a public network. Do I have that right?
My understanding is that traditional messages are insecure when my server talks to someone else's server - so the message itself is likely vulnerable while in transit between servers, but at least with SSL my email password would be safe.
If I understand, PGP or similar would mean that the message itself is encrypted, so that as long as my and the recipient's private keys are safe, nobody else could read the message. But that's just the message, right? Not the IMAP/SMTP/POP connection? Meaning if I used PGP for the message, but a non-SSL connection to SMTP, I'd still be sending plaintext username and password to authenticate.
Basically, I'm trying to understand why an email provider would refuse to offer SSL/TLS for POP/IMAP/SMTP connections - one particular provider says they don't do it because email is inherently insecure anyway, so SSL doesn't actually do anything to protect you, and they suggest PGP for truly secure email. I'd like to argue that while SSL may not be end-to-end message protection, it would at least protect my credentials and protect my message for a significant portion of its journey (me to SMTP server, and POP server to recipient assuming they're connecting with SSL).
Do I have everything straight with that?