4 ms·

My understanding is that it is always historical. There are still people out there who are "I built my own email tools" or "this was setup in 1992 and still wor

My understanding is that it is always historical. There are still people out there who are "I built my own email tools" or "this was setup in 1992 and still works" etc. These aren't a tiny fringe group but asizeable number of sometimes very influential people. As soon as you make a serious breaking change, it brings out all the complaints of "centralisation" of "being forced into something" into "I don't need tls whatever you say" etc. Google try these sorts of things occasionally but although in most cases it is short-term pain for long-term gain, it rarely goes that way.

daneel_w 4y ago
The case of POP3 and STARTTLS vs POP3S is different, because practically all POP3 providers these days require encryption before the e-mail client is allowed to transact. It's the same encryption method/protocol and the same requirement, it's just that POP3S goes straight for the TLS handshake while STARTTLS (with the security concerns detailed in the article) begins talking on an unencrypted channel before getting on with the mandatory handshake.