A Fedora 43 and Dovecot 2.4 upgrade may have uncovered an old Microsoft Outlook behavior where SSL/TLS settings allegedly failed to properly encrypt POP3 email connections.
  • dan@upvote.auEnglish
    3·
    2 months ago

    Someone who’s still using POP instead of IMAP4 probably hasn’t updated their setup in 20 years.

    This is a good reminder to use the secure ports for IMAP (993) and SMTP (465). Don’t use ports that use opportunistic TLS (STARTTLS), which are 143 for IMAP and 587 for SMTP. These start unencrypted and switch to using encryption once the server says it supports it. An attacker can just modify the response and say the server doesn’t support encryption, in which case the connection will remain unencrypted. https://en.wikipedia.org/wiki/Opportunistic_TLS#Weaknesses_and_mitigations

    You can force encryption on the client side… but then you may as well just use the port that’s always encrypted.

    (yes, I know that the TLS handshake isn’t encrypted either)

    • pHr34kY@lemmy.worldEnglish
      3·
      2 months ago

      Forcing encryption reduced my spam by about 99%. Spambots almost never have certificates.

      It also prevented email being delivered from Nintendo, because they can’t tie two network wires together.

    • corsicanguppy@lemmy.caEnglish
      0·
      2 months ago

      Someone who’s still using POP instead of IMAP4 probably hasn’t updated their setup in 20 years.

      You’ll understand one day that pop3s has its uses for certain situations.

        • IsoKiero@sopuli.xyzEnglish
          1·
          2 months ago

          I’ve used that on automated systems. No need to worry about email quota and everything incoming is single-use input for other systems so there’s no need to store messages on the mail server. Sure, you could do that with imap too, but pop3 clients usually don’t leave messages on the server by default, so there’s no need to delete them separately.

          Other case might be to pull the emails from email provider servers so that provider can’t use your emails later. For example if you’re an journalist you might not want to have your emails stored with a 3rd party. Or maybe you’re using some free tier email provider with a very limited quota, which was generally the use case for pop3 before everyone got practically unlimited quota.

          On my personal account I of course use imap since I’ve got multiple devices but pop3 isn’t quite dead yet.

          • dan@upvote.auEnglish
            0·
            2 months ago

            I’ve used that on automated systems. No need to worry about email quota and everything incoming is single-use input for other systems so there’s no need to store messages on the mail server

            You can do this with IMAP as well, you just need to delete and expunge the emails. Any good email client or library will have an option for this.

            POP is literally just downloading all the emails, then deleting them. That’s it.

            You can’t have a script that only downloads emails that match a search (for example emails from a particular sender), since POP doesn’t support search. A basic use case is to check for bills/invoices from certain companies and import them into an accounting system, while leaving other emails untouched.

            You can’t receive emails in real-time and have to instead poll, since POP doesn’t support real time notifications. IMAP supports IMAP IDLE.

            If you have rules that filter emails into folders, you can’t download them via POP, as it doesn’t support folders.

            For automated systems, if you don’t want to store the emails, you can configure the email server to pipe the emails directly to a script. That way they’re not stored at all, and your script gets them immediately rather than having to poll.

            • IsoKiero@sopuli.xyzEnglish
              1·
              2 months ago

              You can do this with IMAP as well, you just need to delete and expunge the emails

              Yes, as I mentioned, but it’s still extra step you need to manage. Not a big one, but extra step anyways.

              For automated systems, if you don’t want to store the emails, you can configure the email server to pipe the emails directly to a script.

              Which is not always an option. You could have the script running on your laptop which isn’t always connected, for example.

              I’m well aware of the differences. I’m just saying that there’s still use cases where pop3 has it’s benefits over imap and discarding it as an ‘old technology’ isn’t always the best route. I’m running my own email server for friends and family and I still have pop3 enabled just in case someone has one of those scenarios where it makes sense to use it.