POP3 Security

[Scott Leibrand]

On 02/11/01 at 7:08pm -0500, Karen Chancellor <KCHAN...@nc.rr.com> wrote:

> Thanks for the yahoo - that works too now. Can ssh work with a
> pop-server like yahoo? I guess my alternative is to establish an ssh
> connection with a server, run pine there and everything would be
> encrypeted, right?

SSH doesn't work with POP3, so that option is out. The alternative of
using an SSH shell to a server would be somewhat more secure, but the POP3
connection between that server and the Yahoo POP3 server would still be
insecure.

I don't know of any secure POP3 methods which Pine supports. I've heard
of POP3 over SSL - does anyone know if Pine supports that? There's also
the possibility of encrypting just your password with something like
CRAM-MD5, but I don't know if Pine supports that over POP3, either. No
matter what method you use, it'd have to be supported by the Yahoo POP3
server, as well. And in my experience, POP3 servers rarely support much
in the way of encryption.

--
Scott Leibrand
leibra...@u.washington.edu (Yes, that is a valid address.)
http://students.washington.edu/leibrand
* Opinions expressed are mine. Everyone else can get their own. :) *
* RCW 19.190 notice: This email address is located in Washington State. *
* Unsolicited commercial email may be billed $500 per message. *

[Alan J. Flavell]

On Sun, 11 Feb 2001, Scott Leibrand wrote:

> SSH doesn't work with POP3, so that option is out.

ssh could forward the POP3 port, just as it can forward any other
port. Of course, this only works if the server where POP is provided
also allows SSH. However, I think you'd find SSL tunnelling more
convenient to use, as well as being applicable to more servers.

> I don't know of any secure POP3 methods which Pine supports.

If it's not supported, use stunnel.

Google's first hit to my query was
http://security.fi.infn.it/tools/stunnel/index-en.html , which looks a
good start.

> I've heard
> of POP3 over SSL - does anyone know if Pine supports that?

I don't know for sure (latest versions support secure IMAP, but I
don't know about POP), however, with stunnel the client doesn't need
to "support" it.

See also http://www.luci.org/luci-discuss/200008/msg00036.html etc.

> No
> matter what method you use, it'd have to be supported by the Yahoo POP3
> server, as well.

Oh, quite; but SSL-wrapped POP and/or IMAP seems to be quite a popular
option.

I still would recommend IMAP in preference to POP.