Re: CRAM-MD5 support in Outlook Express?

From: Miroslav Lachman (000.fbsd_at_quip.cz)
Date: 04/13/04

  • Next message: John Fox: "tcpdump for sniffing POP3 -- methods ?" 
    Date: Tue, 13 Apr 2004 19:40:34 +0200
To: freebsd-isp@freebsd.org

    This link could be useful for you
    http://www.security.nnov.ru/advisories/oespa.asp
    "Outlook Express doesn't support CRAM-MD5 or APOP..."

    I agree with Tim Wilde - SSL can solve this problem.

    Miroslav Lachman

    John Fox wrote:

    > Hello,
    >
    > We're a small ISP (~13,000 email accounts) and I would really like to see
    > us move away from cleartext passwords for our POP3 service. I am currently
    > interested in using CRAM-MD5 authentication, as I already know I will be
    > installing Courier's POP3 daemon, and I've read that it supports CRAM-MD5.
    >
    > I mentioned this idea on a different mailing list, and was told that
    > Outlook Express (which I *must* support) does not have CRAM-MD5 support.
    > However, a friend who is knowledgeable in crypto field told me that
    > CRAM-MD5 has been around a long time, and that he doubts that OE lacks
    > support for it.
    >
    > So I'm writing with two hopes:
    >
    > 1) That someone will confirm or disconfirm the prior assertion that
    > OE does not support CRAM-MD5.
    >
    > 2) That if such support is lacking, perhaps someone else can give
    > me a different idea for getting rid of plaintext authentication
    > for POP3.
    >
    > With thanks and regards,
    >
    > John
    > --
    > +---------------------------------------------------------------------------+
    > | John Fox <jjf @ mind.net> | System Administrator | InfoStructure |
    > +---------------------------------------------------------------------------+
    > | I used to trust the media to tell me the truth, tell us the truth |
    > | But now I've seen the payoffs everywhere I look |
    > | Who can you trust when everyone's a crook? |
    > | -- Queensryche, "Revolution Calling" |
    > +---------------------------------------------------------------------------+
    > _______________________________________________
    > freebsd-isp@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
    > 

    -- 
Miroslav Lachman
Webapplication Developer
_______________________________________________
freebsd-isp@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
  • Next message: John Fox: "tcpdump for sniffing POP3 -- methods ?"