14 ms·

When did POP and IMAP become a “legacy protocol?”

157 points by signa11 4y ago

ljlds3da 4y ago
Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.
- advisedwang 4y ago
  They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/workspace/youtube.
  - jeroenhd 4y ago
    a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already have IMAP authentication methods that use signatures (like most 2FA hardware keys use) or challenge/response methods. You can even do client certificate authentication through STARTTLS when lacking a TPM.
    - 0x457 4y ago
      > What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that. GitHub alone has like 5 different ways to handle 2FA. Google has, I think, 3? Using a browser to handle this simplifies things a lot. b) While it's not fixed by Oauth it greatly limits what can happen: — First, you only need to store a refresh token that can expire and that expiration can be controlled by administrator — Second, that token has limited scope: password provides access to entire account — Third, it's clear where it came from — if token gets compromised, you will know where it happened. With password, it's unclear.
      - jsnell 4y ago
        > Google has, I think, 3? There's at least: 1. SMS 2. TOTP 3. Google Prompt (on Android / iOS) 4. Offline security codes (distinct thing from TOTP, generated from Android settings) 5. Backup codes 6. Security Key
        magicalhippo 4y ago
        Do you have some documentation for this? All I could find[1] pointed to them only supporting OAuth, similar to Microsoft. [1]: https://developers.google.com/gmail/imap/imap-smtp https://developers.google.com/gmail/imap/imap-smtp
        jsnell 4y ago
        I didn't mean that they had native IMAP support for those, but that these are the 2FA methods they support in general. With browser-based OAuth, it's viable to build support for a new 2FA method in just one place. Needing to build each of these into a protocol + get all popular IMAP clients to implement that support? It'd take an eternity; we'd probably still be stuck on just TOTP.
        magicalhippo 4y ago
        Ah yes, my misunderstanding. Indeed, OAuth makes it easy to swap out the actual authentication step. Which is nice, because the service shouldn't really care about that, only that the user is authenticated and authorized.
        0x457 4y ago
        The security Key could also be a Bluetooth-enabled security key or pixel phone.
      - Karellen 4y ago
        > Infrastructure to handle authentication on the web already exists. Email does not run over the web, it runs over the internet. It uses a completely different set of protocols from the web, which were all invented at least 5 years before the first web protocol. Why should email clients be required to add HTTP support in order to make email work? Maybe we should take heed of Zawinski's Law, and make all web browsers implement native email clients instead. Yeah, that's probably it. The Netscape Communicator/Mozilla Suite model should never have been dropped, and it was a mistake to separate Firefox and Thunderbird as separate projects! /s
    - magicalhippo 4y ago
      > What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Our application send mails on behalf of our customers. This is done in an on-prem background service running on one of their servers wherever that might be. So, anything interactive is a no-go. And installing a physical USB key is probably a no-go for most customers, especially those who have their servers hosted by a provider.
    - GoblinSlayer 4y ago
      Client certificate authentication can be done with any TLS, at least it already was in TLS 1.0 published in January 1999, even before SNI.
  - timbit42 4y ago
    Yeah, but they use SMS 2FA which is not secure.
    - advisedwang 4y ago
      Google offers FIDO, and even has an "advance protection" program to enforce only FIDO as 2nd factor.
  - Semaphor 4y ago
    > a) password doesn't support 2nd factor. FWIW, there’s the hacky way reddit clients authenticate: "password:OTP" instead of just your normal password. Not that MS could do that, but I wanted to mention the option ;)
  - nottorp 4y ago
    Whatever their reasoning, it means i have to have an email client and a browser to log in. Can't say I like that.
Avamander 4y ago
I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, it'd not even be entirely wrong to migrate. Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost.
- mattgreenrocks 4y ago
  Shaming people for not having HTTPS on their blog is not a great look. :/
  - chowells 4y ago
    I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.
    - hsbauauvhabzb 4y ago
      Exactly what risk does it have being on a low profile blog?
      - oddlama 4y ago
        I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
        BeefWellington 4y ago
        I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.
afrcnc 4y ago
POP, not IMAP
pessimizer 4y ago
Standards are the enemy because they allow you to use alternate client implementations.
- saagarjha 4y ago
  And enterprises hate this.
  - shadowgovt 4y ago
    It does increase the cost of tech support.
    - saagarjha 4y ago
      Perhaps, but I feel the real reason is their security team tells them they can't control it so they should get rid of it.
      - shadowgovt 4y ago
        Honestly, that's also a good reason.
      - orev 4y ago
        Yes, that’s exactly the reason. Enforcing security is an endless black hole of effort that will increases exponentially with every new thing you need to support. So yes, reducing the number of things that need to be evaluated isn’t just some security guy trying to control everyone, it’s a hard requirement just to be able to have security at all.
achillean 4y ago
The protocols are seeing a decline in deployments but they're still very popular. See the below for a trend of the protocol over the past 5 years: https://imgur.com/a/uIAiM9B https://imgur.com/a/uIAiM9B
a-dub 4y ago
you have to jump through hoops to do basic auth (even over SSL) for IMAP/pop with gmail as well. (this has been true for some years now) on one level, it's sad to see the open protocols go... on the other, google passwords are a big deal.
- edg5000 4y ago
  What hoops are you referring to? Regarding the password, Google requires you to use an App Password, e.g. a password used solely for POP/IMAP, separate form you Google password. I suppose setting up POP/IMAP nowadays would involve: - Enable POP/IMAP in GMail settings - Set an App Password - Enter email address, full name and App Password in Thunderbird first-time use wizard. I suppose this can be a pain if you are not aware of these 2 settings, for newcomers they would likely need a tutorial. However this setup is really a one-time process.
- stemc43 4y ago
  > google passwords at my work - they are disabled in our enterprise account - no alternative to oauth. I think they may even be disabled by default in general in gmail.
jonathantf2 4y ago
You can still enable these protocols per user - Microsoft are disabling these and Basic Authentication by default as most users don’t use them and it’s the primary vector for sending emails from compromised accounts. Any Microsoft tenant I set up or manage already has policies to block anything but the Outlook desktop or mobile clients with MFA on every account.
- b215826 4y ago
  > You can still enable these protocols per user From what I understand, Microsoft will disable basic authentication starting January 2023, and the next few months are sort of a "grace period" to migrate to Microsoft's new authentication protocol [1]: > On September 1, 2022, we announced there will be one final opportunity to postpone this change. Tenants will be allowed to re-enable a protocol once between October 1, 2022 and December 31, 2022. Any protocol exceptions or re-enabled protocols will be turned off early in January 2023, with no possibility of further use. See the full announcement at Basic Authentication Deprecation in Exchange Online – September 2022 Update. > Microsoft are disabling these and Basic Authentication as most users don’t use them and it’s the primary vector for sending emails from compromised accounts Even if most users don't use basic auth, I don't see why Microsoft has to disable it altogether. For people who want to keep using legacy clients, it's not too hard to force the usage of application-specific passwords. [1] https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online https://learn.microsoft.com/en-us/exchange/clients-and-mobil...
  - jonathantf2 4y ago
    I'm referring to IMAP/POP, you'll be able to use these with OAuth instead of basic auth. I imagine their stats show that 99 percent of users use Outlook of some sort so to up security they turned basic auth off.
    - denton-scratch 4y ago
      So Microsoft want you to switch from (awful) Basic Auth to a Microsoft-modified version of OAuth, is that it? I don't use Microsoft mail services, except as SMTP destinations. Does Outlook not support Digest Auth? Digest Auth certainly isn't perfect (I seem to remember that it requires an extra roundtrip), but it's not a security disaster like Basic Auth. My main problem with OAuth is that it's hard for users to understand. If we expect users to use the internet securely, then they need to be able to know when that's not what they're doing, and I don't know any ordinary Joe that I could explain OAuth to. Hell, I implemented OAuth once, and now I can't remember how it works. It doesn't help that OAuth is a moving target.
melony 4y ago
What about Macrosoft Exchange?
belorn 4y ago
Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or simply look at this as one in a line of steps in a specific direction.
- jonathantf2 4y ago
  This is completely false, I've just installed the Mail app on my Windows 11 machine, first thing it asks you is what e-mail provider you use [0] and there are options for iCloud, Yahoo and a generic IMAP setup along with the Microsoft offerings. [0] https://files.catbox.moe/ljil4h.png https://files.catbox.moe/ljil4h.png
  - belorn 4y ago
    Maybe it depend on which license/tablet? I have worked with customers with that issue in the past and the option for generic imap has not been there. Double checked and you are right, it was this issue that I recalled: https://support.microsoft.com/en-us/office/add-your-other-email-accounts-to-outlook-com-c5224df4-5885-4e79-91ba-523aa743f0ba https://support.microsoft.com/en-us/office/add-your-other-em...
    - jonathantf2 4y ago
      I'm running Pro but I've seen plenty of people with Home/Core machines using the default Mail app, no idea why since it's so much worse than the webmail option
- Shorel 4y ago
  Any relationship with Godaddy sounds dirty. They are basically imposing the worst registrar ever on customers, for this particular scenario.
- Semaphor 4y ago
okasaki 4y ago
> I do have to wonder how long until Google decides that only certain clients can connect with Gmail? Already the case on mobile: > If you use the Play store or GitHub version of FairEmail, you can use the quick setup wizard to easily setup a Gmail account and identity. The Gmail quick setup wizard is not available for third party builds, like the F-Droid build because Google approved the use of OAuth for official builds only. OAuth is also not available on devices without Google services, such as recent Huawei devices, in which case selecting an account will fail. https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq6 https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-co...
- Wowfunhappy 4y ago
  Can you get around this by setting an App Specific password on your Google account?
  - tadfisher 4y ago
    That functionality was removed in favor of OAuth. I'm not sure M66B needs to get approval for the other builds, though, because the access is gated at the cloud API, not though client libraries. You can use Play Services to grant OAuth tokens, or you can use the boring old Google API client libraries, or roll your own; you just need to add the other signing key fingerprints and application IDs to the credential in the project's cloud console. I could easily be mistaken, but there are numerous open-source projects acting as mail clients through the GMail API, Google has granted them access, and they don't have to use a closed-source client to do it. Most of them don't even target Android.
    - Wowfunhappy 4y ago
      > That functionality was removed in favor of OAuth. Huh? I'm using it right now in order to use Gmail in an email client that doesn't support OAuth.
      - okasaki 4y ago
josephcsible 4y ago
Are there any open standards that Microsoft is still going to support to receive emails, or will you be required to use only their proprietary clients to do so going forward?
bfrog 4y ago
Since web apps became the only thing people create anymore
TopYemen 4y ago
Nice
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
ltratt 4y ago
For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are: Email OAuth 2.0 Proxy <https://github.com/simonrob/email-oauth2-proxy https://github.com/simonrob/email-oauth2-proxy>; mailctl <https://github.com/pdobsan/mailctl https://github.com/pdobsan/mailctl>; mutt_oauth2.py <https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_o...> (some suggestion that it might not always work these days?); pizauth <https://github.com/ltratt/pizauth https://github.com/ltratt/pizauth>; oauth-helper-office-365 <https://github.com/ahrex/oauth-helper-office-365 https://github.com/ahrex/oauth-helper-office-365>. Disclaimer: I wrote pizauth and it's just about to move into the alpha stage.
- trasz 4y ago
  Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.
  - Avamander 4y ago
    God forbid you actually have functioning token rotation and revocation alongside 2FA. So insecure. /s
    - megous 4y ago
      What does oauth have to tho with authentication (let alone 2FA)?
      - magicalhippo 4y ago
        Besides being used for authentication? https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://learn.microsoft.com/en-us/exchange/client-developer/...
TrianguloY 4y ago
Strange than no one talked about gmailify: that protocol that replaced pop and imap on gmail so that you can't see your email on other providers unless google accepts them.
28304283409234 4y ago
So glad someone invented davmail: https://davmail.sourceforge.net/index.html https://davmail.sourceforge.net/index.html
murderfs 4y ago
Ignoring authentication, POP and IMAP truly are legacy protocols in the sense that they were designed in an era where bandwidth, not latency was the major constraint for accessing email. It made sense to send a notification that the size of your inbox changed, and let the client decide whether or not to fetch your emails. Since then, internet connections have gotten tens of thousands of times more bandwidth, but the speed of light hasn't improved correspondingly.
- qwerty456127 4y ago
  Now or then, whatever the bandwidth or latency, why couldn't we just use a REST web service which would let a client access whatever the parameter incl. mailbox size, list the messages, read the messages in form of JSON/XML arrays of metadata + message bodies in Markdown format?
  - weird-eye-issue 4y ago
    There are Google and Microsoft APIs for exactly this. Well not markdown exactly but since emails are not sent in markdown it would be kind of subjective exactly how to properly convert it
  - HelloNurse 4y ago
    Because without a standard protocol they would be N underspecified proprietary variants: the Gmail web service, the Office 365 web service, the Office 365 from last year web service... All of them with complicated authentication requirements, idiosyncratic URL construction, and other difficulties. You would throw away the baby and keep the bathwater.
    - qwerty456127 4y ago
      I meant a standardized REST protocol. Why does it have (or ever had) to be something obscure like SMTP/POP3/IMAP if it could be just REST (still standardized, name it whatever)?
      - 4y ago
qwerty456127 4y ago
By the way, I wonder if GMail and Microsoft servers still use SMTP to exchange mail between them.
nailer 4y ago
TLDR: when IMAP didn't standardize push, and when people started to use HTTP for everything. JMAP is the current hotness.
- welterde 4y ago
  IMAP IDLE exists since 1997 (RFC2177) and works decent enough for single mailboxes. It is limited to only a single mailbox however, which is not quite ideal if one does server-side filtering (as one then needs N connections for N folders). But for that there is IMAP NOTIFY (RFC5465) since 2009, which covers all remaining use cases..

157 points by signa11 4y ago

Their plan is to remove old text-only protocols, and force to use XAUTH or similar protocols that requires use of a web browser, so they can spy you with cookies and more metadata. Both Google and Microsoft are announced this movement.

advisedwang 4y ago
They're removing plain text auth because: a) password doesn't support 2nd factor. b) Most configurations keep password is on disk somewhere, often in plaintext. c) User configurations break on password rotation. Your tracking theory doesn't really hold up a) they know exactly who you are on your email client anyway as you log in and b) most users are logged in to their google/microsoft account anyway because of o375/workspace/youtube.
- jeroenhd 4y ago
  a) is only relevant once, during setup; b) isn't fixed by Oauth; c) is by design, I'd argue. I support adding 2FA to email in some way, but I heavily dislike using browsers to do so. What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? This can all be standardised without a browser ever touching the email client. We already have IMAP authentication methods that use signatures (like most 2FA hardware keys use) or challenge/response methods. You can even do client certificate authentication through STARTTLS when lacking a TPM.
  - 0x457 4y ago
    > What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Infrastructure to handle authentication on the web already exists. This is a massive benefit for providers and client developers. Whatever you propose does not. Good luck convincing big email providers to agree on a new standard like that. GitHub alone has like 5 different ways to handle 2FA. Google has, I think, 3? Using a browser to handle this simplifies things a lot. b) While it's not fixed by Oauth it greatly limits what can happen: — First, you only need to store a refresh token that can expire and that expiration can be controlled by administrator — Second, that token has limited scope: password provides access to entire account — Third, it's clear where it came from — if token gets compromised, you will know where it happened. With password, it's unclear.
    - jsnell 4y ago
      > Google has, I think, 3? There's at least: 1. SMS 2. TOTP 3. Google Prompt (on Android / iOS) 4. Offline security codes (distinct thing from TOTP, generated from Android settings) 5. Backup codes 6. Security Key
      - magicalhippo 4y ago
        Do you have some documentation for this? All I could find[1] pointed to them only supporting OAuth, similar to Microsoft. [1]: https://developers.google.com/gmail/imap/imap-smtp https://developers.google.com/gmail/imap/imap-smtp
        jsnell 4y ago
        I didn't mean that they had native IMAP support for those, but that these are the 2FA methods they support in general. With browser-based OAuth, it's viable to build support for a new 2FA method in just one place. Needing to build each of these into a protocol + get all popular IMAP clients to implement that support? It'd take an eternity; we'd probably still be stuck on just TOTP.
        magicalhippo 4y ago
        Ah yes, my misunderstanding. Indeed, OAuth makes it easy to swap out the actual authentication step. Which is nice, because the service shouldn't really care about that, only that the user is authenticated and authorized.
      - 0x457 4y ago
        The security Key could also be a Bluetooth-enabled security key or pixel phone.
    - Karellen 4y ago
      > Infrastructure to handle authentication on the web already exists. Email does not run over the web, it runs over the internet. It uses a completely different set of protocols from the web, which were all invented at least 5 years before the first web protocol. Why should email clients be required to add HTTP support in order to make email work? Maybe we should take heed of Zawinski's Law, and make all web browsers implement native email clients instead. Yeah, that's probably it. The Netscape Communicator/Mozilla Suite model should never have been dropped, and it was a mistake to separate Firefox and Thunderbird as separate projects! /s
  - magicalhippo 4y ago
    > What's wrong with adding a simple challenge-response protocol for FIDO2/U2F USB drives? Or a TOTP popup if you don't have a physical security key? Our application send mails on behalf of our customers. This is done in an on-prem background service running on one of their servers wherever that might be. So, anything interactive is a no-go. And installing a physical USB key is probably a no-go for most customers, especially those who have their servers hosted by a provider.
  - GoblinSlayer 4y ago
    Client certificate authentication can be done with any TLS, at least it already was in TLS 1.0 published in January 1999, even before SNI.
- timbit42 4y ago
  Yeah, but they use SMS 2FA which is not secure.
  - advisedwang 4y ago
    Google offers FIDO, and even has an "advance protection" program to enforce only FIDO as 2nd factor.
- Semaphor 4y ago
  > a) password doesn't support 2nd factor. FWIW, there’s the hacky way reddit clients authenticate: "password:OTP" instead of just your normal password. Not that MS could do that, but I wanted to mention the option ;)
- nottorp 4y ago
  Whatever their reasoning, it means i have to have an email client and a browser to log in. Can't say I like that.

Avamander 4y ago

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, it'd not even be entirely wrong to migrate. Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost.

mattgreenrocks 4y ago
Shaming people for not having HTTPS on their blog is not a great look. :/
- chowells 4y ago
  I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.
  - hsbauauvhabzb 4y ago
    Exactly what risk does it have being on a low profile blog?
    - oddlama 4y ago
      I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
      - BeefWellington 4y ago
        I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.

afrcnc 4y ago

POP, not IMAP

pessimizer 4y ago

Standards are the enemy because they allow you to use alternate client implementations.

saagarjha 4y ago
And enterprises hate this.
- shadowgovt 4y ago
  It does increase the cost of tech support.
  - saagarjha 4y ago
    Perhaps, but I feel the real reason is their security team tells them they can't control it so they should get rid of it.
    - shadowgovt 4y ago
      Honestly, that's also a good reason.
    - orev 4y ago
      Yes, that’s exactly the reason. Enforcing security is an endless black hole of effort that will increases exponentially with every new thing you need to support. So yes, reducing the number of things that need to be evaluated isn’t just some security guy trying to control everyone, it’s a hard requirement just to be able to have security at all.

achillean 4y ago

The protocols are seeing a decline in deployments but they're still very popular. See the below for a trend of the protocol over the past 5 years: https://imgur.com/a/uIAiM9B https://imgur.com/a/uIAiM9B

a-dub 4y ago

you have to jump through hoops to do basic auth (even over SSL) for IMAP/pop with gmail as well. (this has been true for some years now) on one level, it's sad to see the open protocols go... on the other, google passwords are a big deal.

edg5000 4y ago
What hoops are you referring to? Regarding the password, Google requires you to use an App Password, e.g. a password used solely for POP/IMAP, separate form you Google password. I suppose setting up POP/IMAP nowadays would involve: - Enable POP/IMAP in GMail settings - Set an App Password - Enter email address, full name and App Password in Thunderbird first-time use wizard. I suppose this can be a pain if you are not aware of these 2 settings, for newcomers they would likely need a tutorial. However this setup is really a one-time process.
stemc43 4y ago
> google passwords at my work - they are disabled in our enterprise account - no alternative to oauth. I think they may even be disabled by default in general in gmail.

jonathantf2 4y ago

You can still enable these protocols per user - Microsoft are disabling these and Basic Authentication by default as most users don’t use them and it’s the primary vector for sending emails from compromised accounts. Any Microsoft tenant I set up or manage already has policies to block anything but the Outlook desktop or mobile clients with MFA on every account.

b215826 4y ago
> You can still enable these protocols per user From what I understand, Microsoft will disable basic authentication starting January 2023, and the next few months are sort of a "grace period" to migrate to Microsoft's new authentication protocol [1]: > On September 1, 2022, we announced there will be one final opportunity to postpone this change. Tenants will be allowed to re-enable a protocol once between October 1, 2022 and December 31, 2022. Any protocol exceptions or re-enabled protocols will be turned off early in January 2023, with no possibility of further use. See the full announcement at Basic Authentication Deprecation in Exchange Online – September 2022 Update. > Microsoft are disabling these and Basic Authentication as most users don’t use them and it’s the primary vector for sending emails from compromised accounts Even if most users don't use basic auth, I don't see why Microsoft has to disable it altogether. For people who want to keep using legacy clients, it's not too hard to force the usage of application-specific passwords. [1] https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online https://learn.microsoft.com/en-us/exchange/clients-and-mobil...
- jonathantf2 4y ago
  I'm referring to IMAP/POP, you'll be able to use these with OAuth instead of basic auth. I imagine their stats show that 99 percent of users use Outlook of some sort so to up security they turned basic auth off.
  - denton-scratch 4y ago
    So Microsoft want you to switch from (awful) Basic Auth to a Microsoft-modified version of OAuth, is that it? I don't use Microsoft mail services, except as SMTP destinations. Does Outlook not support Digest Auth? Digest Auth certainly isn't perfect (I seem to remember that it requires an extra roundtrip), but it's not a security disaster like Basic Auth. My main problem with OAuth is that it's hard for users to understand. If we expect users to use the internet securely, then they need to be able to know when that's not what they're doing, and I don't know any ordinary Joe that I could explain OAuth to. Hell, I implemented OAuth once, and now I can't remember how it works. It doesn't help that OAuth is a moving target.

melony 4y ago

What about Macrosoft Exchange?

belorn 4y ago

Some context: Microsoft has disabled the use of alternative email providers in Windows' built-in email app since Windows 10, and for 365 users, unless you got one of the more expensive accounts intended for large companies, then no custom domain names for your email unless you use Godaddy as registrar. They have an exclusivity deal with Microsoft. So sure, one can look at this from an authentication perspective, or simply look at this as one in a line of steps in a specific direction.

jonathantf2 4y ago
This is completely false, I've just installed the Mail app on my Windows 11 machine, first thing it asks you is what e-mail provider you use [0] and there are options for iCloud, Yahoo and a generic IMAP setup along with the Microsoft offerings. [0] https://files.catbox.moe/ljil4h.png https://files.catbox.moe/ljil4h.png
- belorn 4y ago
  Maybe it depend on which license/tablet? I have worked with customers with that issue in the past and the option for generic imap has not been there. Double checked and you are right, it was this issue that I recalled: https://support.microsoft.com/en-us/office/add-your-other-email-accounts-to-outlook-com-c5224df4-5885-4e79-91ba-523aa743f0ba https://support.microsoft.com/en-us/office/add-your-other-em...
  - jonathantf2 4y ago
    I'm running Pro but I've seen plenty of people with Home/Core machines using the default Mail app, no idea why since it's so much worse than the webmail option
Shorel 4y ago
Any relationship with Godaddy sounds dirty. They are basically imposing the worst registrar ever on customers, for this particular scenario.
Semaphor 4y ago

okasaki 4y ago

> I do have to wonder how long until Google decides that only certain clients can connect with Gmail? Already the case on mobile: > If you use the Play store or GitHub version of FairEmail, you can use the quick setup wizard to easily setup a Gmail account and identity. The Gmail quick setup wizard is not available for third party builds, like the F-Droid build because Google approved the use of OAuth for official builds only. OAuth is also not available on devices without Google services, such as recent Huawei devices, in which case selecting an account will fail. https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq6 https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-co...

Wowfunhappy 4y ago
Can you get around this by setting an App Specific password on your Google account?
- tadfisher 4y ago
  That functionality was removed in favor of OAuth. I'm not sure M66B needs to get approval for the other builds, though, because the access is gated at the cloud API, not though client libraries. You can use Play Services to grant OAuth tokens, or you can use the boring old Google API client libraries, or roll your own; you just need to add the other signing key fingerprints and application IDs to the credential in the project's cloud console. I could easily be mistaken, but there are numerous open-source projects acting as mail clients through the GMail API, Google has granted them access, and they don't have to use a closed-source client to do it. Most of them don't even target Android.
  - Wowfunhappy 4y ago
    > That functionality was removed in favor of OAuth. Huh? I'm using it right now in order to use Gmail in an email client that doesn't support OAuth.
    - okasaki 4y ago

josephcsible 4y ago

Are there any open standards that Microsoft is still going to support to receive emails, or will you be required to use only their proprietary clients to do so going forward?

bfrog 4y ago

Since web apps became the only thing people create anymore

TopYemen 4y ago

Nice

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

ltratt 4y ago

For those of us with Unix-y mail setups the move to OAuth2 can be a bit tricky, but there are now several different programs to help (spurred, I suspect in no small part, by Microsoft/Exchange's stance). The ones I know about are: Email OAuth 2.0 Proxy <https://github.com/simonrob/email-oauth2-proxy https://github.com/simonrob/email-oauth2-proxy>; mailctl <https://github.com/pdobsan/mailctl https://github.com/pdobsan/mailctl>; mutt_oauth2.py <https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_oauth2.py https://gitlab.com/muttmua/mutt/-/blob/master/contrib/mutt_o...> (some suggestion that it might not always work these days?); pizauth <https://github.com/ltratt/pizauth https://github.com/ltratt/pizauth>; oauth-helper-office-365 <https://github.com/ahrex/oauth-helper-office-365 https://github.com/ahrex/oauth-helper-office-365>. Disclaimer: I wrote pizauth and it's just about to move into the alpha stage.

trasz 4y ago
Not only it’s tricky and user-hostile, but it also severely decreases security by forcing people to use fundamentally insecure mechanism to obtain the authentication token.
- Avamander 4y ago
  God forbid you actually have functioning token rotation and revocation alongside 2FA. So insecure. /s
  - megous 4y ago
    What does oauth have to tho with authentication (let alone 2FA)?
    - magicalhippo 4y ago
      Besides being used for authentication? https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth https://learn.microsoft.com/en-us/exchange/client-developer/...

TrianguloY 4y ago

Strange than no one talked about gmailify: that protocol that replaced pop and imap on gmail so that you can't see your email on other providers unless google accepts them.

28304283409234 4y ago

So glad someone invented davmail: https://davmail.sourceforge.net/index.html https://davmail.sourceforge.net/index.html

murderfs 4y ago

Ignoring authentication, POP and IMAP truly are legacy protocols in the sense that they were designed in an era where bandwidth, not latency was the major constraint for accessing email. It made sense to send a notification that the size of your inbox changed, and let the client decide whether or not to fetch your emails. Since then, internet connections have gotten tens of thousands of times more bandwidth, but the speed of light hasn't improved correspondingly.

qwerty456127 4y ago
Now or then, whatever the bandwidth or latency, why couldn't we just use a REST web service which would let a client access whatever the parameter incl. mailbox size, list the messages, read the messages in form of JSON/XML arrays of metadata + message bodies in Markdown format?
- weird-eye-issue 4y ago
  There are Google and Microsoft APIs for exactly this. Well not markdown exactly but since emails are not sent in markdown it would be kind of subjective exactly how to properly convert it
- HelloNurse 4y ago
  Because without a standard protocol they would be N underspecified proprietary variants: the Gmail web service, the Office 365 web service, the Office 365 from last year web service... All of them with complicated authentication requirements, idiosyncratic URL construction, and other difficulties. You would throw away the baby and keep the bathwater.
  - qwerty456127 4y ago
    I meant a standardized REST protocol. Why does it have (or ever had) to be something obscure like SMTP/POP3/IMAP if it could be just REST (still standardized, name it whatever)?
    - 4y ago

qwerty456127 4y ago

By the way, I wonder if GMail and Microsoft servers still use SMTP to exchange mail between them.

nailer 4y ago

TLDR: when IMAP didn't standardize push, and when people started to use HTTP for everything. JMAP is the current hotness.

welterde 4y ago
IMAP IDLE exists since 1997 (RFC2177) and works decent enough for single mailboxes. It is limited to only a single mailbox however, which is not quite ideal if one does server-side filtering (as one then needs N connections for N folders). But for that there is IMAP NOTIFY (RFC5465) since 2009, which covers all remaining use cases..