62
votes
Accepted
How do email clients "send later" without storing a password?
Sparks stores your account credentials on their systems. This is also described in their privacy policy:
INFORMATION WE COLLECT AND HOW WE USE THIS INFORMATION
Auth login or mail server ...
- 208k
12
votes
How do email clients "send later" without storing a password?
Any online service that acts on your behalf with other network services will normally need to store the credentials needed for those other services. While there are other ways to implement ...
- 612
10
votes
Does IMAP/POP3/ASP undermine Two-Factor Auth?
You are not missing anything.
It is a convenience option that usually has to be opted into specifically when 2FA is enabled - and somewhat defies 2FA.
Otherwise, smart phones and email clients would ...
- 14.5k
6
votes
Does IMAP/POP3/ASP undermine Two-Factor Auth?
Authentication on the server side isn't magic. It's just algorithms doing what algorithms do. If 2FA is enabled on a site, the site will ask for your password, then assuming that is correct, it will ...
- 1,483
4
votes
Accepted
What is the purpose of opportunistic TLS (like STARTTLS)?
In order:
Is the use of opportunistic TLS just for backwards compatibility (with a known/used port)?
Yes. When you have an existing service it is helpful to allow it to use TLS if the ...
- 36k
4
votes
Email including self-shredding macro after "Seen" flag is set
No, it's not possible. It would be difficult to implement securely, and also pointless because of all the ways to get around it. What if Alice saves the email externally? Or screenshots it? Or uses an ...
- 316
3
votes
Anything wrong with using IMAP as authentication for a web app to achieve a kind of easy SSO?
It is technically possible. IMAP is a well known and well described protocol, so you could easily code the authentication by hand. I used to use telnet mailserver 143 for debugging and if I correctly ...
- 26.9k
3
votes
Accepted
Anything wrong with using IMAP as authentication for a web app to achieve a kind of easy SSO?
Does this already exist?
Checking login with one service in order to authenticate another one is kind of hackish but actually not that unusual. The Postfix mail server can be configured to check with ...
- 208k
3
votes
Why Thunderbird has private IP address as remote host?
The information you see here are self-reported by the mail server, i.e.:
$ openssl s_client -connect imap.mail.yahoo.com:993
...
* OK [CAPABILITY IMAP4rev1 SASL-IR AUTH=PLAIN AUTH=XOAUTH2 AUTH=...
- 208k
3
votes
Accepted
Outlook for Android uses intermediate Microsoft Servers
Is it possible that they could be authenticating over a TLS tunnel from their own server rather than the client device without sharing
the credentials?
No, for the server to make the connection, ...
- 73.3k
3
votes
Accepted
Why does my password appear in clear text with my smartphone mail IMAP application?
It appears in cleartext because you don't use transport layer security (tls) when connecting to your mail host.
In order to change it, reconfigure your mail account on the galaxy (both the incoming ...
- 9,293
3
votes
Finding and attacking an IMAP Server
The initial intuition would be that there is no way to tell a domain's IMAP server in a similar way as you could just lookup a domain's MX (SMTP) server through the DNS system.
But there is; at least ...
- 838
3
votes
Better safety: Webmail or POP3/IMAP email client?
I can't see difference if we are talking just about data transfer. If HTTPS, POP3S, IMAPS and SMTPS protocols are in use of course. Always use secured versions of protocols.
If we are talking about ...
- 1,230
2
votes
Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?
Port 465 has been un-obsoleted
As per Wikipedia:
https://en.wikipedia.org/wiki/SMTPS:
RFC 8314 "Cleartext Considered Obsolete: Use of TLS for Email Submission and Access" reinstates the ...
- 18.2k
2
votes
Why are common services using implicit SSL not considered obsolete in the way that SMTPS is?
tl;dr:
Because neither implicit nor explicit TLS is technically that bad;
Because changing ways the Internet works takes time.
This is essentially not one, but two different questions, and I'll ...
- 3,496
2
votes
Accepted
Why do OpenSSL and Python return different SSL fingerprints?
According to the openssl command line below, my mail server's SSL certificate fingerprint is 393c7c58738fa6643cedd9943ffb6e951b2d3b576991d9671d86921ee79bb68a:
openssl s_client -connect onza.mythic-...
- 208k
2
votes
Accepted
Risks in open POP3/IMAP ports?
There is no generic POP3 or IMAP vulnerability. In fact, you'll find open ports for this on many servers in the internet since these protocols are used to retrieve e-mail - hopefully in combination ...
- 208k
2
votes
Accepted
Open IMAP connection using hashed password
The supported authentication methods depend on the specific IMAP server. Some supported methods like XOAUTH2 which delegate the authentication to some external server via OAuth2. There are also ...
- 208k
2
votes
Could IMAP authentication be adapted to support 2FA?
Could IMAP authentication be adapted to support 2FA?
IMAP can support multiple authentication methods, i.e. the protocol is extensible.
... why hasn't it been done
It has been done. Modern ...
- 208k
2
votes
Why Thunderbird has private IP address as remote host?
Naturally you won't see any connections to 10.0.0.0/8 as it's a private network, and per RFC 1918, 3 wouldn't be routed even if there was that kind of address involved:
Because private addresses have ...
- 19.4k
2
votes
What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?
It contains AUTH=PLAIN but also contains STARTTLS. The latter indicates that the server supports an encrypted connection optionally, not necessarily enforced. So to my understanding the client is ...
- 1,726
2
votes
What does the IMAP banner alone show regarding security (STARTTLS, hashing, information disclosure)?
So to my understanding the client is still able to use AUTH=PLAIN alone, without STARTTLS and therefore is also probably vulnerable to some kind of downgrade attack.
Providing both STARTTLS and AUTH=...
- 208k
1
vote
Accepted
IMAP credentials in WEB (browser) app - how to use securely
Based on the comments following the question:
You might want to consider encrypting the IMAP credentials on the client-side (in-browser, using the javascript web crypto api), using an encryption key ...
- 24.1k
1
vote
Accepted
Domain offline - are unmaintained email clients a security risk?
If you have a domain that has handled important email for you, you need to keep it registered forever or at least until any email you might receive is completely useless.
An attacker can easily buy ...
- 300
1
vote
Accepted
Finding and attacking an IMAP Server
You can check mail server DNS listings for a domain with dig (linux). Glad to hear it's an approved honey pot. Good luck.
dig [domain] MX
example:
dig google.com MX
; <<>> DiG 9.9.4-...
- 1,905
1
vote
How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?
I don't believe OpenPGP has a mechanism built in to handle this situation. If your goal is to have a repository of emails, all encrypted with a single non-publicly-shared identity's key I'd suggest ...
- 535
1
vote
What security settings is Yahoo Mail looking for to consider IMAP client secure?
That setting is used to block (or permit) password auth to Yahoo's POP3/IMAP/SMTP servers. They want you to use OAuth tokens instead.
The advantage of OAuth is that the app itself doesn't actually ...
- 52.2k
1
vote
Better safety: Webmail or POP3/IMAP email client?
For protections against vulnerabilities, there are pros and cons to either platform. While both share the same core issue of the exploitation of an application vulnerability. Since either platform is ...
- 111
1
vote
Accepted
IMAP with authentication set to none
No, that means that the communication from your computer to the IMAP server is not encrypted. You still need to send your username and password to the server, but it is visible to someone sniffing ...
- 34.7k
1
vote
What is the purpose of opportunistic TLS (like STARTTLS)?
Can the same "level of security" as properly configured TLS be achieved through the use of opportunistic TLS?
It can be, if used correctly. When using FTP, for example, your client can inform you ...
- 34.4k
Only top scored, non community-wiki answers of a minimum length are eligible