4

Which is more secure, IMAP or POP?

I realize IMAP and POP both support SSL/TLS connections, but I am concerned more about messages remaining on the server.

It seems POP would be more secure because can't you configure it not to leave messages on the server? Or does IMAP also support that?

Also, which protocol would be more amenable to being integrated with Lavabit-like services like Tutanota?

Improve this question
2
  • 2
    When asking "is this secure" you need to specify your security requirements - see this question
    – paj28
    Commented Aug 11, 2016 at 8:56
  • POP (assuming POP3 here) has separate commands to retrieve a message (RETR) and to delete a message (DELE). UA implementation choices have no bearing on its ability to leave messages on the server. tools.ietf.org/html/rfc1939#page-8
    – user
    Commented Aug 11, 2016 at 15:35

2 Answers 2

Reset to default
8

There are several aspects of security and which one is more secure for you depends on your environment and requirements:

  • If you have a problem with leaving the mails at a server you don't control:
    Both POP and IMAP can leave the mails on the server but can also delete the from the server. But usually IMAP is used in a way to leave them at the server while POP is used to just get and delete them from the server. Not that in both cases the mails are still at least for some time at the server, so if you don't trust the server at all you've lost anyway.
  • If you care about encrypted transport to defend against man in the middle:
    Both have the option to use TLS.
  • If you care risks introduced by the implementation of the protocol in server or client:
    IMAP is a way more complex protocol than POP and thus the risks of an insecure implementation are much higher there.
  • If you care about data loss:
    The servers of the providers are usually better maintained than a desktop system, i.e. professional providers have redundancy, backups etc. So leaving the data at the server (usually with IMAP) might be an advantage.
  • If you want some firewall in between to scan the messages for malware:
    POP is the more simple protocol to implement in firewalls too. It is only used to retrieve full messages (or maybe the header only) while IMAP can be used to only retrieve a specific part of the message like the body data of a specific attachment or even a specific byte range. This feature is especially used when mobile clients are used which try to reduce bandwidth use by only loading attachments on demand. But even the Thunderbird mail client on desktops transfers by default large message in multiple chunks. This behavior makes it much harder for firewalls to inspect IMAP traffic because they might miss essential context like the Content-Transfer-Encoding or the filename of the attachment or the previous chunk of a message which are needed for proper scanning. See for example the section Understanding IMAP Antivirus Scanning Limitations in the description of IMAP scanning in Juniper products and many other firewalls have similar limitations (but often don't document these) or even do not support IMAP at all.
Improve this answer
4
  • Firewall is the wrong layer to scan email messages anyway. Most MUA and MTA supports passing incoming and/or outgoing emails and/or attachments to antivirus scanner before processing them.
    – Lie Ryan
    Commented Aug 11, 2016 at 7:14
  • @LieRyan: The mail server might be controlled by an external provider where you don't have full control about the security. Also, there is a time difference between scanning incoming mail (i.e. SMTP) and scanning mail when it gets read (POP, IMAP) which can be crucial when detecting new malware. Apart from that there is defense in depth, i.e. don't rely on a single security measure.
    – Steffen Ullrich
    Commented Aug 11, 2016 at 7:28
  • Point is, the firewall is the wrong layer to do those kind of things. You want to detect and fix application layer problems (i.e. viruses, spam) in the application layer. The more products you throw in between just means that there are more products that can be exploited by attackers.
    – Lie Ryan
    Commented Aug 11, 2016 at 8:25
  • @LieRyan: Application layer firewalls (most NGFW, UTM, IPS, SG, ...) are the right layer to handle application layer problems. The simple packet filter firewalls (iptables, ipfw...) are not the right layer.
    – Steffen Ullrich
    Commented Aug 11, 2016 at 8:28
1

Neither.
If you can't trust the server, all bets are off, because any mail has to pass it anyways.
Regarding connections, neither is encrypted etc. in it's original form.

Btw., yes, mail clients can be configured to delete IMAP mails from the server.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .