MBOX-Line: From jkt at flaska.net  Wed Mar 19 04:56:08 2014
To: imap-protocol@u.washington.edu
From: =?iso-8859-1?Q?Jan_Kundr=E1t?= <jkt@flaska.net>
Date: Fri Jun  8 12:34:52 2018
Subject: [Imap-protocol] STARTTLS after PREAUTH
In-Reply-To: <fcf9f696-1314-4110-9495-24a22ce91ba8@gulbrandsen.priv.no>
References: <059bac1f-35eb-4f87-bd5e-e986dfb46b83@flaska.net>
	<fcf9f696-1314-4110-9495-24a22ce91ba8@gulbrandsen.priv.no>
Message-ID: <f0f9f8a9-62fb-4220-b998-bc2092cb5144@flaska.net>

On Tuesday, 18 March 2014 23:01:12 CEST, Arnt Gulbrandsen wrote:
> Think about it this way. As a client author, how do you handle 
> the case where the server sends you PREAUTH and you want to use 
> TLS?

Oops. Thanks for an excellent suggestion, Arnt. It turns out that Trojita 
silenty fails to establish encryption when the remote server greets us with 
an initial PREAUTH. That might lead to information leak (APPEND of 
messages, confirmation of mailbox names), but never to credentials being 
transmitted in plaintext (Trojita understands what PREAUTH is, and won't 
attempt to LOGIN or AUTHENTICATE in that case).

/me checks how to file a CVE...

With kind regards,
Jan

-- 
Trojit?, a fast Qt IMAP e-mail client -- http://trojita.flaska.net/

