I'm using Dovecot for IMAP connections.
I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow:
auth_mechanisms = plain login
Why should I not allow *-md5 authentication, too? Like so:
auth_mechanisms = plain login digest-md5 cram-md5
I know that the server has to store the password in unencrypted form in order to support *-md5 auth mechanisms.
But does that decrease security in any way? I mean everyone who has access to the server can read the password anyway:
Either by directly reading the un-encrypted (plain) password from disk if I use *-md5 auth, or by waiting for my email client to connect to my server and then extracting the plain password it sends if I use
So what's the deal of not using md5 auth?
For sure my server always uses TLS/SSL IMAP sessions.