Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Several people are claiming that you should turn off pop3 in gmail because it allowed bruteforce attacks on the password.

Doesn't Google prevent this kind of attacks? What is the truth on this claims?

IMAP is so slow with Outlook that I really want to keep using POP. I have a strong password in place.

share|improve this question

If the password is strong, then there is no worry whatsoever.

POP3 does not open new ways for cracking passwords IF you use it sensibly, i.e. within SSL/TLS. Otherwise, depending on the underlying authentication mechanism, a hash of your password may transit on an unprotected connection (bad !), or maybe even the password itself (worse !).

A feature of POP is that the emails are removed from the gmail servers once you retrieved them, so:

  • you can no longer read them through the gmail Web interface;
  • you no longer benefit from the disk redundancy and automatic backups of the Google infrastructure;
  • you can read your emails locally even when deprived of an Internet connection.

Therefore, this is not only a problem of performance and brute-force attacks.

share|improve this answer
GMail forces you to use SSL to connect – Eduardo Molteni Oct 13 '11 at 22:25
GMail has three options: Delete from Gmail servers once fetched, Archive them out of the inbox, or leave them where they are. (either way, they do keep track and make sure the same email is not POP3'd twice) Your answer seems to assume that the first option is all there is which is the case in many places, but not GMail. – George Bailey Oct 13 '11 at 22:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.