On Fri, 28 Dec 2001, ambarish pathak wrote:
> I always thought IMAP was an insecure as POP3 is. Will you
> please elaborate? Thanks in advance.
IMAP allows authentication through either the LOGIN or AUTHENTICATE
commands. The LOGIN command sends username and password as plaintext,
while AUTHENTICATE provides a general mechanism for a variety of
authentication techniques. (RFC2060)
Using AUTHENTICATE, I could for example use KERBEROS, GSSAPI or S/Key
(RFC1731). S/Key does not provide protection, but the others do.
I guess it could be extended to add other authentication mechanisms too,
since no additional commands need to be added to the protocol to support
it.
Philip
--
You cannot have a science without measurement.
-- R. W. Hamming
Visit my webpage at http://www.ncst.ernet.in/~philip/
Read my writings at http://www.ncst.ernet.in/~philip/writings/
MSN philiptellis Yahoo! philiptellis
AIM philiptellis ICQ 129711328
_______________________________________________
http://mm.ilug-bom.org.in/mailman/listinfo/linuxers
