Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [imap]

Internet Message Access Protocol, or IMAP, is a mail protocol used in the retrieval of mail from a mailbox. In comparison to POP, IMAP is designed to allow the complete management of a mailbox using multiple different mail clients, this means that unlike POP, mail retrieved over the IMAP protocol will by default also remain on the mail server, unless explicitly deleted by the user.

3
votes
2answers
97 views

Outlook for Android uses intermediate Microsoft Servers

I have an IMAP + SMTP server running on linux, using Dovecot + Postfix. The server only accepts connections over TLS and uses plaintext authentication once the tunnel is established. I was auditing ...
2
votes
2answers
70 views

Domain offline - are unmaintained email clients a security risk?

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment. However, I wonder what would ...
0
votes
1answer
2k views

Risks in open POP3/IMAP ports?

I found a domain with open POP3 (110) and IMAP (143) ports. I was able to use TELNET to connect to them successfully, but beyond this is there any common vulnerability/exploit I should test on them, ...
1
vote
2answers
564 views

Finding and attacking an IMAP Server

For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra. So far I failed, since I've given hydra the actual website instead of the mail ...
0
votes
1answer
328 views

Why do OpenSSL and Python return different SSL fingerprints?

I use getmail, a tool written in Python, to retrieve my mail via IMAP. Today it suddenly stopped working because it complains about an SSL fingerprint mismatch. (I always specify the fingerprint to ...
2
votes
1answer
99 views

How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?

For pgp encryption I'd like to combine short expiry terms for public signing and email encryption with (convenient) long term decryption possibilities of my mailbox mails. I'm using several mail ...
9
votes
4answers
4k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
7
votes
2answers
530 views

Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?

SMTPS (implicit SSL) has been deprecated/obsolete since SMTP+STARTTLS (explicit SSL) was defined in RFC2487. I'm not entirely clear on the reasoning behind that, but it was clearly considered a good ...
0
votes
1answer
383 views

What security settings is Yahoo Mail looking for to consider IMAP client secure?

When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled. The client is configured to use SSL for IMAP (and SMTP). What ...
4
votes
2answers
365 views

Better safety: Webmail or POP3/IMAP clent?

Which offers a higher level of safety: Webmail or using a POP3/IMAP client? Assume the following for webmail: Access via HTTPS Rarely downloading any attachments, but in cases where it may be ...
0
votes
1answer
52 views

IMAP with authentication set to none

While adding a Mediacom email account into Apple Mail I referenced their page on IMAP settings https://supportstage.mediacomcable.com/print/1446, I noticed that authentication type for incoming email ...
2
votes
3answers
800 views

What is the purpose of opportunistic TLS (like STARTTLS)?

Opportunistic TLS refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate ...
3
votes
1answer
98 views

Why does my password appear in clear text with my smartphone mail IMAP application?

I am using the default Galaxy 5 mail application to fetch my mail with IMAP. Packet capture shows my user and password in clear text (see below). Why does my username and password appear in clear ...
0
votes
1answer
312 views

Random persistent Gmail password requests from Google

I am trying to figure out something for my father in law. This persistent popup keeps interrupting anything anyone is doing on his desktop by requesting he put in his password. I told him not to. It ...
0
votes
2answers
47 views

Reconcile IMAP4 RFC with No RC4 RFC

RFC 3501 states: IMAP client and server implementations MUST implement the TLS_RSA_WITH_RC4_128_MD5. RFC 7465 states: o TLS clients MUST NOT include RC4 cipher suites in the ClientHello ...
3
votes
0answers
289 views

How secure is PHP IMAP? [closed]

I'm working on a project for one of my customers. They want a web environment where the site searches for specific emails for specific users and makes the attachments of those emails accessible to ...
7
votes
2answers
537 views

How does Google store passwords for remote IMAP/POP services?

It is possible to add non-Google accounts to Gmail and retrieve their mail messages via POP or IMAP. As part of the setup process, one has to provide the login username and password for these accounts....
2
votes
1answer
1k views

Why doesn't outlook 2013 meet modern security standards?

It is required to turn on the allow less secure apps setting in order to be able to use a gmail account with outlook 2013, despite it is using the IMAP and SMTP services with SSL protocol enabled. ...
8
votes
2answers
347 views

How can I track someone logged in my gmail account over imap?

Gmail tells me if someone new logged in to the web-interface (device, browser etc.) But what about IMAP logins? If someone has my password can he stealthy read my mails over IMAP?
3
votes
2answers
230 views

Reading mail from GMail with secure access

I recently implemented PHP code with IMAP for reading mails from a GMail account and further executing some command depending on the mail body. I got this to work after consulting the first answer ...
4
votes
0answers
463 views

Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?

I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security? Here is ...
3
votes
4answers
477 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
2
votes
3answers
467 views

Fake “FROM” email to allocate to account

We are allocating emails to their online account. We discovered you can send a false email with a script by changing the "from" or "reply-to" in the email header. There must be a safe way to test the ...
-1
votes
1answer
1k views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
1
vote
1answer
2k views

Is my Postfix and Dovecot configuration secure?

Today I set up my first server with Dovecot and Postfix. These are excerpts from the configuration files: Dovecot: disable_plaintext_auth = yes ssl = required ssl_prefer_server_ciphers = yes ...
3
votes
1answer
109 views

Opening mail from IMAP with no risk for the user

I'm building a website for an association. Its aim is to, out of other thing, provide an easy mail manager to communicate with the member, stored in a database. This database is always up to date as ...
71
votes
3answers
78k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
9
votes
2answers
7k views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
3
votes
1answer
2k views

Do the BEAST and CRIME attacks apply to an IMAP service?

While setting up the Dovecot IMAP service, I noticed that the default parameters are not optimal, it allows SSLv3 for example. Using Thomas Pournin's TestSSLServer.java program, I saw the following: ....
1
vote
1answer
2k views

Distributed IMAP-Dictionary-Attack-Tool?

I have a client with a hacked IMAP-Account, and the attacker(s) made thousands of password-attempts, probably with a fixed set of passwords, from different IPs before they got in. After successful ...