Hot answers tagged protocols
4
CRAM-MD5 requires that the server knows the actual password, not just some image of the password by a hash function. So if the server has to support HMAC-MD5, it has to store the password in plaintext. (The server can encrypt the password, but since it also has to know the encryption key, that doesn't help.)
CRAM-MD5 was designed to avoid having the ...
3
Firstly, it's not necessary to use plaintext:
Looking at the HMAC-MD5 implementation in psuedocode:
you can at least store a modified version of the password:
if (length(key) > blocksize) then
key = hash(key) // keys longer than blocksize are shortened
end if
if (length(key) < blocksize) then
key = key ∥ [0x00 * ...
2
It gives no protection against MITM since an attacker could forward the challenge to the client. Requiring plaintext password storage is bad and the exchange can have have a dictionary attack run against it.
You are justified in being worried about this scheme and I'd personally suggest using a different e-mail provider.
1
There are three relevant weaknesses in this case:
Improper password storage: If your provider's database is compromised, your password is directly exposed. Although some implementations of CRAM-MD5 don't store passwords in plaintext, the hashed password is still unstaled. So far there's no known implementation that salts the password (the salt needs to be ...
1
First off, the plaintext bit is bullshit - most POP/SMTP *nix solutions can be retrofitted to not need this. With this out of the way...
...CRAM-MD5 has shocking vulnerabilities - coming from its MD5 tie. However, it's still better than plaintext. In order of appearance and "OMGWTFBBQ-ness":
A server using CRAM-MD5 can be spoofed/MitM-ed as the client ...
Only top voted, non community-wiki answers of a minimum length are eligible
