Why not use md5 auth mechanisms for IMAP over TLS?

Question

I'm using Dovecot for IMAP connections.

I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow:
auth_mechanisms = plain login

Why should I not allow *-md5 authentication, too? Like so:
auth_mechanisms = plain login digest-md5 cram-md5

I know that the server has to store the password in unencrypted form in order to support *-md5 auth mechanisms.
But does that decrease security in any way? I mean everyone who has access to the server can read the password anyway:
Either by directly reading the un-encrypted (plain) password from disk if I use *-md5 auth, or by waiting for my email client to connect to my server and then extracting the plain password it sends if I use plain or login auth.

So what's the deal of not using md5 auth?

EDIT:
For sure my server always uses TLS/SSL IMAP sessions.

Answer 1

Technically there is no reason to not use Digest MD5 with TLS, but it does not add additional security for the password within the connection between client and server. So you need to check if using Digest MD5 might decrease the security of the rest of the system.

Often you want to integrate the IMAP users with the system users, that is any system user can access their IMAP account with the same password used for login or for sending mail (i.e. SMTP). Since passwords are usually stored in hashed form on the system you would need to have an additional storage for the plain text password (or HA1) just to support the Digest MD5 authorization and keep both password stores in sync. This is not only a hassle but would also degrade system security.

If you don't use system accounts for IMAP the situation might be different. In most cases it is probably still more secure to store the passwords hashed only, because it might be easier to steal the plain text password file than to hijack or replace the IMAP server. But, if you have remote authentication which supports Digest MD5 (like with a Radius server not secured by TLS) it might be preferable to use Digest MD5 then.