Re: POP3 password in plaintext?

[David Kastrup <dak@gnu.org>]

Richard Stallman <rms@gnu.org> writes:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>     Transparent STARTTLS on demand would seem useless against
>     man-in-the-middle attacks.  It's just good against eavesdropping on
>     unintercepted traffic.  And you don't even need to be true
>     man-in-the-middle: you just need to be faster answering the STARTTLS
>     negotiation.
>
> Are other protocols for fetching mail better
> in security?
>
> David Caldwell <david@porkrind.org> wrote:
>
>     Modern POP/IMAP clients tend to have a checkbox or a setting to require
>     SSL/TLS when connecting. If the protocol doesn't start TLS (and isn't
>     connected to an SSL port) then it is considered a connection error. This
>     setting is configured up-front, at the same time that the user
>     configures the server name and port. In this day and age it might make
>     sense to have such a checkbox default to "on".
>
> That makes sense -- if STARTTLS in POP3 is fundamentally adequate.
> But if Kastrup is right, that isn't so.

My bet is on Kastrup not being right.  But I'd be interested to know
why.

-- 
David Kastrup