3 ms·
IMAP does accept plain text passwords, but this is not a real security threat either because of TLS. I hate all the FUD security blogs that tell you otherwise.
by raxxorrax 5y ago
IMAP does accept plain text passwords, but this is not a real security threat either because of TLS. I hate all the FUD security blogs that tell you otherwise. This "industry" has become extremely useless and doesn't even give sensible security advice anymore.
Yes, of couse 2FA is theoretically better. Until facebooks leaks half a billion phone numbers + account information. That is a vastly more serious threat.
I don't know a single case where TLS was compromised from an IMAP client. Perhaps if it is 15 years old? I hate this industry so damn much. People should be homeless, not security advisers...
- gruez 5y ago>I don't know a single case where TLS was compromised from an IMAP client. Perhaps if it is 15 years old? I hate this industry so damn much. People should be homeless, not security advisers... You're thinking of the wrong threat model. They're not concerned about passwords being stolen being in transit, but rather using the IMAP endpoint for credential stuffing attempts. An IMAP login attempt contains very little zero metadata, so it's very hard to judge whether it's legitimate or not. With a web login you can get tons of stuff to judge the authenticity of the user, eg. fingerprinting.
- grishka 5y agoOn a related note: people like criticizing Telegram because its encryption is "not industry standard". Except Telegram has existed for 8 years now, and MTProto encryption still hasn't been compromised.