Re: nnimap over SSL

[Simon Josefsson <simon@josefsson.org>]

Arcady Genkin <antipode@thpoon.com> writes:

> I added (nnimap-server-port 993) and (nnimap-stream ssl) to the
> backend configuration.  In the messages below the line about
> ``Plaintext authentication'' is worrying me a bit.  Is the password
> encrypted?

Yes and no -- you're sending a cleartext password to the server,
albeit over a encrypted channel (assuming SSL is in fact used).  Use
`lsof' or `netstat' or similar to find out what connection actually is
used.

If you don't trust the encrypted network and/or the unauthenticated
server enough to handle your cleartext password (rather than using
some kind of challenge/response protocol), you should be worried.  In
practice, your current solution is good for passive attacks (network
sniffing) but is still open to active attacks (redirect server
hostname or network hijacking).

> Also, this might be off-topic, but I wonder where openssl stores the
> certificate it retrieves from the server (I'm using a self-signed
> certificate).

I believe it's only printed to stdout (or maybe stderr).

Frob `imap-ssl-program' and add CA certs and verification stuff and
the server will be authenticated.  This means server hostname
redirection or network routing hijacking won't work, but an attack
against the mail server itself would still collect your password.

The next step would be to not send your password in clear, using
CRAM/DIGEST-MD5, Kerberos, STARTTLS with client-certs, Ssh+imapd or
whatever.