3 ms·

I’ve heard imap is insecure. I’ve disabled it by default but this is intriguing. Anybody have any more information on imap security?

• herpderperator 7y ago
  If you are concerned about someone reading your emails in transit, make sure you use TLS. IMAP is standard; as far as I know, almost everything uses it.
• dspillett 7y ago
  Any references for where you've heard this? Then we can check the claims and perhaps reassure you or suggest workarounds. What are you using instead? IMAP is on its own insecure because it is a plain protocol, but it can be used in conjunction with TLS to add secure transport. Exactly the same can be said for many other mail protocols such as POP3.
  • revicon 7y ago
    Google spreads a lot of FUD (right or wrong) about anything that doesn’t use their oAuth. https://www.zdnet.com/article/google-were-banning-these-insecure-apps-from-connecting-to-g-suite-accounts/ https://www.zdnet.com/article/google-were-banning-these-inse...
• andris9 7y ago
  The "insecurity" in IMAP mostly comes from password based authentication. The client application needs to know cleartext account password to use it and the same password, if leaked, can usually be used to manage the account. While browser based applications are pretty good already for blocking unintended usage, showing captchas to block bots etc, then it is way harder to do the same on the IMAP server side. So in general it comes down to configuration. IMAP per se is not insecure. How you use it though, might be.