Hot answers tagged protocols
7
CRAM-MD5 requires that the server knows the actual password, not just some image of the password by a hash function. So if the server has to support HMAC-MD5, it has to store the password in plaintext. (The server can encrypt the password, but since it also has to know the encryption key, that doesn't help.)
CRAM-MD5 was designed to avoid having the ...
6
A man-in-the-middle attack is a simultaneous double impersonation: Charlie poses as Alice when he talks to Bob, as Bob when he talks to Alice. Since both conversations are simultaneous, Charlie can elect to pass chunks of data from Alice directly to Bob and vice-versa, adding his own parts selectively.
If Alice and Bob have a shared secret K, which Charlie ...
3
There are three relevant weaknesses in this case:
Improper password storage: If your provider's database is compromised, your password is directly exposed. Although some implementations of CRAM-MD5 don't store passwords in plaintext, the hashed password is still unstaled. So far there's no known implementation that salts the password (the salt needs to be ...
3
Firstly, it's not necessary to use plaintext:
Looking at the HMAC-MD5 implementation in psuedocode:
you can at least store a modified version of the password:
if (length(key) > blocksize) then
key = hash(key) // keys longer than blocksize are shortened
end if
if (length(key) < blocksize) then
key = key ∥ [0x00 * ...
3
It gives no protection against MITM since an attacker could forward the challenge to the client. Requiring plaintext password storage is bad and the exchange can have have a dictionary attack run against it.
You are justified in being worried about this scheme and I'd personally suggest using a different e-mail provider.
2
Public key cryptography is for when there are several distinct entites, i.e. he who decrypts is not the same person than he who encrypts; similarly, when we want people to be able to verify signatures without granting them the technical power to produce signatures of their own.
Public key cryptography is not inherently "more secure" or "less secure" than ...
1
First off, the plaintext bit is bullshit - most POP/SMTP *nix solutions can be retrofitted to not need this. With this out of the way...
...CRAM-MD5 has shocking vulnerabilities - coming from its MD5 tie. However, it's still better than plaintext. In order of appearance and "OMGWTFBBQ-ness":
A server using CRAM-MD5 can be spoofed/MitM-ed as the client ...
Only top voted, non community-wiki answers of a minimum length are eligible
