I'm not sure that Seth's response is completely true, or accurate. As per the RFC 2595 (http://tools.ietf.org/html/rfc2595) and my understanding / server setup: There are two questions being asked as I see it: 1) Are passwords encrypted? 2) Is the communication encrypted? POP3, IMAP and SMTP all, by default, send plain-text passwords. Over an unencrypted channel this can mean anyone with the will to do so can read your password as easily as this message. To combat this you can either: 1) Send your password encrypted (e.g. the CRAM_MD5 setting in k-9 mail) - the server must support this. 2) Encrypt the whole connection (using POPS, IMAPS, or SMTPS - the final S stands for Secure!). Option 1 means that the password is encrypted so nobody else can gain access to your account by imitating you, but the rest of the communication / messages are not encrypted and could be read by anybody. Option 2 means everything (*including the password*) is encrypted from the start of the communication with the server. This uses the SSL protocol (the same protocol that is used for HTTPS). Often (but not always) the port number for the server is changed to help identify this added security POPS - 995, IMAPS - 993, SMTPS - 465. The problem with option 2 is that once your message reaches the server it becomes unencrypted. This is not a problem for most people who are not sending sensitive documents by e-mail, but is why many businesses and healthcare providers ban you from using non work e-mail whilst at work. Once your message reaches GMail, Hotmail or any-other-mail-provider they could technically read your message, change it, and then send it to its destination. To combat this, you can encrypt the actual message. This is separate from the connection encryption, and requires you to use PGP and the sender to have a key to open your message.
<https://lh5.googleusercontent.com/-Ee9T6Rq_-Lk/Uxhhv19RLiI/AAAAAAAAAAM/35Ar1UuG5qU/s1600/IMAPS.jpg> The whole system can be breached by man-in-the-middle attacks, as Ola suggests, which are used legitimately in office environments to check all your SSL communication. Man-in-the-middle requires a compromised computer (which, at work your IT dept may have deliberately compromised your desktop by adding a certificate authority). Finally, I think Seth's statement about Proxies is incorrect. The point of a proxy is to make a connection via another server. This can be to hide your location, to gain access to the internet from inside a local network or probably many other reasons. A non compromised computer will not be affected by sending SSL information across a proxy - it remains encrypted as is very hard to break. Plain text via proxy could be read by anyone though. You may need a proxy with encrypted traffic - it depends why you're using the proxy!! -- -- You received this message because you are subscribed to the K-9 Mail Users List. To post to this group, send email to [email protected] To unsubscribe, email [email protected] To report an issue with K-9 Mail, visit http://code.google.com/p/k9mail/issues/list For more options, visit this group at http://groups.google.com/group/k-9-mail --- You received this message because you are subscribed to the Google Groups "K-9 Mail" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
