Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It appears that whenever you set up a new mail account on Mac Mail (or on iPhone etc), that as soon as you enter the server and the mail account password, Mac Mail tries to connect to the mail server. However this connection occurs before you can set the SSL option. So it looks like the initial connection transmits the mail account password as plain text.

It looks to me like all Apple devices (i.e. iPhones, iPads, Mac Computers) use basically the same process, and appear to make an initial connection to the mail server without using SSL.

This seems like a very insecure configuration. If this is happening then this is a pretty major security flaw. It would mean that users of Mac Mail applications could easily have their mail passwords read by their ISPs or anyone else (???) who had access to the line during that set up phase.

Apart from not using Apple products there is a way around it, but I think 99.9% of people are not going to realize this is happening. On OS X you can choose a different Mail App, but I don't think that is an option on iPhones, iPads etc. So potentially this might mean 100s of millions of people using mail on an Apple products have transmitted their mail passwords in plain text at some point.

Anyone running Wire Shark or something similar able verify this is happening?

share|improve this question

IMAP (Internet Message Access Protocol) is most likely the connection you're using. IMAP is an asynchronous protocol, and allows for some communication before authentication, such as CAPABILITY, which asks the server what protocols and authentication methods the server supports; NOOP, which is used to prevent timeouts; and LOGOUT, which ends the session.

The IMAP protocol authenticates users using a Simple Authentication and Security Layer (SASL) exchange. This process starts with a STARTTLS command, which initiates a Transport Layer Security (TLS) connection, which is an encryption protocol.

Once the TLS connection is established, your password may be transmitted using the SASL command PLAIN (which is plaintext), but the PLAIN command is only supported by modern mail services after the STARTTLS command establishes an encrypted connection. SASL does support additional security, like DIGEST-MD5.

That said, an IMAP server may accept a PLAIN login before a TLS connection is established, but that wouldn't be a shortcoming of the security of the Mail applications for OS X/iOS.

So your password should never be sent in the clear by the Mail application for iOS / OS X to IMAP servers that properly utilize STARTTLS

POP3 is another story, and some older ISPs may indeed authenticate using a plaintext exchange. But again this is not a fault to Mail for OS X / iOS, just the reality that some plaintext protocols are still in widespread use.

Additional reading:

TechNet How It Works: IMAP 4

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .