dovecot - Jun 2019 - Help on CRAM-MD5

I don't desagree with your vision, but if the use of CRAM-XXXX has to use
plaint text password's on the server there's a dark side, or there's
a
CRAM-XXX that can use encrypted on server side? There's always the thing
that can clients don't support it.
I think i'm not wrong with what i said,

On 20 Jun 2019, at 02:53, FUSTE Emmanuel via dovecot <dovecot at
dovecot.org>
wrote:
> There is plenty of context where TLS is not possible/desirable.
I'd say that is terrible advice. There are no reasonable contexts where is
it is acceptable to send mail credentials without encryption. My users have
had to use STARTTLS for submission for many many years. Insecure connections
from users are not an option.
> And without client certificate, mutual strong authentication is not 
> available,
For certain values of strong, sure. But nearly no one needs mutual strong
authentication to the level that client certs are necessary, and if someone
does need them, then that is not a significant hurdle. And the connections
are still encrypted.

*ALL* user to server transactions should be encrypted and nothing should be
willfully downgrading security in the flawed reasoning of convenience. That
is why we have as many security issue as we do right now; we are still
living down the legacy of the previous century's lack of security at ever
stage in design.




--
Yeah, Nick. Nick's the kinda guy you can trust. Nick's your buddy
Nick's the
kinda guy you drink beers with. The kinda guy that doesn't care if you puke
in his car. Nick.

On 20 Jun 2019, at 04:14, Jorge Bastos via dovecot <dovecot at
dovecot.org> wrote:
> I don't desagree with your vision, but if the use of CRAM-XXXX has to
use
> plaint text password's on the server there's a dark side, or
there's a
> CRAM-XXX that can use encrypted on server side? There's always the
thing
> that can clients don't support it.
The ?encrypted? password store that CRAM-MD5 supports is MD5 which cannot be
classified as encryption at this point.

Not sure why  you are saying CRAM-XXX as there is only CRAM-MD5.

-- 
Lead me not into temptation, I can find the way.

Le 20/06/2019 ? 12:25, @lbutlr via dovecot a ?crit?:
> On 20 Jun 2019, at 04:14, Jorge Bastos via dovecot <dovecot at
dovecot.org> wrote:
>> I don't desagree with your vision, but if the use of CRAM-XXXX has
to use
>> plaint text password's on the server there's a dark side, or
there's a
>> CRAM-XXX that can use encrypted on server side? There's always the
thing
>> that can clients don't support it.
> The ?encrypted? password store that CRAM-MD5 supports is MD5 which cannot
be classified as encryption at this point.
>
> Not sure why  you are saying CRAM-XXX as there is only CRAM-MD5.
>
I think he is referring to my reference to SCRAM-XXX class of mech.