Re: [Imap-protocol] STARTTLS after PREAUTH
Dave Warren <[email protected]>
| Newsgroups | gmane.mail.imap.general |
|---|---|
| Message-ID | <[email protected]> |
On 2014-03-18 19:23, Bron Gondwana wrote: > Sadly, they're still out there - which is why FastMail doesn't allow port 143 at all. Port 993 appears to be working in the real world[tm]. > > I'd be interested in seeing the actual stats for which clients can be convinced by a MITM to give up their credentials in plaintext in their default configuration. Don't give me a checkbox which requires the user to actively increase the security level, because that won't work. In fact, don't even give the user a dialog which allows them to send the password insecurely, because they will. > > Not responding to a SYN on port 143 with an ACK... If you put together a list, be sure to exclude clients that either ignore certificate errors, or have users that ignore certificate errors. SSL solves nothing when users are already trained to just ignore errors and proceed anyway. -- Dave Warren http://www.hireahit.com/ http://ca.linkedin.com/in/davejwarren _______________________________________________ Imap-protocol mailing list [email protected] http://mailman13.u.washington.edu/mailman/listinfo/imap-protocol