>> Can anyone clarify further or do some tests to see if K9 is actually
>sending
>> passwords in plain text?
>
>You are terribly misunderstanding things. HTTPS is recommended for web
>traffic, it's true. But HTTPS is not used for e-mail traffic. You are
>using
>SMTP and (IMAP or POP3). There are SSL/TLS encrypted versions of SMTP
>and IMAP
>(and possibly POP3, I don't honestly know). However, the authentication
>
>portion, unless configured to do so, is not encrypted this way. it's a
>separate option. Look at your Account Settings -> Fetching Mail ->
>Incoming
>server settings. There is an option for authentication which can be
>Plain or
>CRAM_MD5.
>
This is NOT correct. "Starttls" is the first command that is sent from the
client to the server, and the only thing that is sent unencrypted. If ssl
(imaps and smtps) is used. The entire session is encrypted.
HOWEVER, if tls/ssl is not used, you can use IE cram-md5 to encrypt the
authentication even if the rest of the session (the actual transfer of the
email) is unencrypted.
>Under Accout Settings -> Sending Mail -> Outgoing server settings there
>is a
>similar option.
>
>The point of using a proxy is to encrypt traffic on an unknown network.
>But if
>the proxy itself is unsecured and unknown, it's far worse than just
>going
>direct because it's logging your traffic and you're letting some
>unknown
>person or persons read your traffic. If everything is encrypted, you
>don't
>need the proxy.
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
--
--
You received this message because you are subscribed to the K-9 Mail Users List.
To post to this group, send email to [email protected]
To unsubscribe, email [email protected]
To report an issue with K-9 Mail, visit
http://code.google.com/p/k9mail/issues/list
For more options, visit this group at http://groups.google.com/group/k-9-mail
---
You received this message because you are subscribed to the Google Groups "K-9
Mail" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
