28 Oct
2011
28 Oct
'11
11:33 a.m.
This thread is all the proof you should need of the potential of MITM
attacks, here both the client and server support it, however due to a
3rd party messing with packets, encryption is utterly useless.
So encryption is doing it's job, blocking a third party from
intercepting the data. I don't see that the fault is the tech involved here.
The only
potential problem is allowing clients that aren't encrypted:
you can
either say "that's their problem", or require that the server deny all
client
commands_except_ STARTTLS on an unencrypted connection. To be
honest, I have
no idea why we have this constant dual-allocation of ports for single
services. It's a waste of well-known port numbers; http/https included.
Exactly, we should only bother with HTTPS/POP3S/IMAPS/SSMTP and do away
with clear text communication altogether...