[feature request] IMAP always uses PLAIN authentication [released]

wait, do you mean that until now all IMAP connections sent the password in clear text?

I checked my mail over some unencripted holtel wifi networks while travelling knowing that the IMAP servers I used all provided strong authentication (IMAP SSL).

https://wiki.gandi.net/en/mail/standard-settings?s[]=imap#popimap_account

Did my IMAP passwords travel in clear text then? I'm sure the port configured in Mail was 993, the one of IMAP SSL.

Now I have the phone at Optima for warranty repair, so I can't double check (but I did a full /home/nemo backup, if you tell me where I can look)

Thank you

@c.la - No, passwords are not sent before SSL connection are established, no AUTH is not even support for IMAP accounts, both PLAIN and LOGIN use weak encryption but we never allow them over unencrypted connection, same for 99.9% of the servers out there.

@VDVsx thank you for your reply. I still don't get how you can block the transmission of PLAIN (if I remember it's equivalent to not encrypted) authentication over an unencrypted channel, because after all even 3G connection is unencrypted, not just an open wifi network.

Thank you

Like I said above authentication does not process until a SSL/TLS socket is open between server and device, if you want more details check the IMAP RFCs on that, and as I said when available we use even stronger methods like app token or MD5, but most servers don't support those.

good, thank you for the explanation