The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
22 views

How do I interact with Google to import email via imapsync? [on hold]

I am developing an webapp that allows users to migrate a backup of their old mail into an existing webmail account using imapsync. The source of the mail is an old webmail system owned and ...
3
votes
4answers
105 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
2
votes
3answers
213 views

Fake “FROM” email to allocate to account

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the ...
-1
votes
1answer
114 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
0
votes
1answer
217 views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
4
votes
1answer
68 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
22
votes
3answers
8k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
3
votes
3answers
824 views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
3
votes
1answer
1k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ...
1
vote
1answer
727 views

Distributed IMAP-Dictionary-Attack-Tool?

I have a client with a hacked IMAP-Account, and the attacker(s) made thousands of password-attempts, probably with a fixed set of passwords, from different IPs before they got in. After successful ...