Re: how to prevent clear text IMAP authorization?

It does NOT "first try SSL". When you specify /ssl, it ONLY uses SSL and
NEVER uses any other means of session encryption.
[...]
In an SSL session, the ENTIRE session is encrypted, including the
authentication.

Authentication has the possibility of an ADDITIONAL layer of encryption,
on top of the SSL encryption, so that you do not ever disclose your
password to the server but instead prove that you know the password
without disclosing it. These are mechanisms with names such as CRAM-MD5
or Kerberos.

Thank you for clarifying this. Great, so I have little to worry about
then (unless the server gets compromised, or I do not fix the
certificate issue below). Wonder why they still use plain text in the
21st century (even if the traffic is encrypted) ... but googling will
help find some answers to that.

By the way, your use of /novalidate-cert makes you vulnerable to a fake
server spoofing your real server. You would be better off making sure
that your server's certificate is installed on your system, so you can
verify that it is really your server.

Thanks for pointing this out, will ask the local admins for the
certificate (they should have this general IMAP thingy even if they
are not pine experts).

----

Sorry for taking this much of your time,

mc

.

Relevant Pages

  • Re: Help with SSL for Exchange 2003
    ... and Outlook, however, I cannot get SMTP to work properly. ... If I select SSL encryption the error I get is: "Your server does not ... Event Category: Authentication ...
    (microsoft.public.exchange.admin)
  • Re: Handheld device remote networking issues into RAS
    ... I set "Store password using reverisble encryption for all users in the ... This is off by default in server 2003. ... >> The user domain\user failed an authentication attempt due to the ... >> password policy or the password settings on the user account. ...
    (microsoft.public.windows.server.networking)
  • Re: Help with SSL for Exchange 2003
    ... and Outlook, however, I cannot get SMTP to work properly. ... If I select SSL encryption the error I get is: "Your server does not ... Event Category: Authentication ...
    (microsoft.public.exchange.admin)
  • Re: encrypt password for webservices
    ... Requests can be multi-threaded, and some requests can even be droped if ... By associating a session with an IPrincipal object, ... > Client generates a session key and sends it to the server encrypted ... congratulations on getting a grip on security and encryption. ...
    (microsoft.public.dotnet.security)
  • Re: Fast User Switching in Domain Member mode / Authentication Tic
    ... > desktop computers and 1 SBS Server) ... >> authentication which would only exist on a domain computer. ... No public key encryption is used. ... >> you would have a robust authentication method for workgroup computers. ...
    (microsoft.public.platformsdk.security)