1

I recall seeing a large email corporation discourage POP client access, suggesting it was insecure.

Assuming this is not FUD meant to encourage adoption of their client, I am wondering whether either of these may be true:

  1. This has a basis in truth in that POP is insecure without the proper extensions, but POP can be as secure as any other method by use of the right extensions/protocols.
  2. There is something inherently defective as to security with the POP protocol even if the most secure extensions are used.

Might someone be able to offer a high level introduction to what, if any, issues POP may suffer from?

| improve this question | |
  • 2
    Could you specify what kind of security are you concerned with? – VLAZ Mar 20 at 6:57
  • Any kind of vulnerability that is inherent within the spec and which some other similar protocol has a means of circumventing. – Brett Zamir Mar 20 at 8:34
  • So, basically, any security problems whatsoever? I think it could be argued that all systems have some vulnerabilities. If you want your system to be totally secure, unplug it. – Robert Harvey Mar 21 at 20:28
  • Firstly, I used a poor choice of words in saying "circumventing" a vulnerability. I should have said "avoiding" one. So, no, I wasn't speaking of all security problems, just those which a similar (or even hypothetical) protocol doesn't have. I am also speaking mostly of insurmountable obstacles to the spec, e.g., if the spec required some insecure practice. – Brett Zamir Mar 22 at 1:47
4

After a quick glance at the Wikipedia Article, yes, I would say that there are some security concerns with the protocol:

  • The use of TLS is optional and negotiated between client and server.
  • So is the use of a challenge/response protocol (APOP) for authentication instead of sending the password in plaintext.
  • And the challenge/response protocol is based on MD5
  • Other authentication method also exist, again optional and subject to negotiation.

So you can run POP securely (somewhat, MD5 is broken in theory, if not in practice), but without technical knowledge and looking closely, you cannot be sure that your specific POP communication is being run securely.

| improve this answer | |
  • 1
    Working in China here without a VPN, and with Wikipedia blocked, couldn't access. Thank you! – Brett Zamir Mar 20 at 9:39
1

Another issue, which was not mentioned in Michael's great answer is that POP clients usually moves the message from the email server to the local computer. When a user lost their computer or it goes wrong their emails could be lost.

| improve this answer | |
  • 2
    In some ways, moving email off of the server can improve security (at the expense of multi-device access) a bit since if someone gets access to your account they can't see all that email that is normally left on the server. Also, email can be accesses without needing an Internet connection. Maintaining proper backups can mitigate the dead harddrive/system issue. That doesn't make up for all the shortcomings of POP, though. – 1201ProgramAlarm Mar 21 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.