Subject: pop-gw encrypted?

From: "Luis Fernando Barrera" <[email-masked]>
Date: Fri, 29 Sep 2000 14:51:42 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

Is there a way to encrypt the connection between some external user
and the pop-gw of the FWTK? Thus, not sending the user/password
of the outlook client (for example) in clear text...

I've seen an option of the pop-gw called APOP, but I understant that its
purpose is not to encrypt the user/password.
As far as I know the POP3 protocol itself sends the user/password in clear text...

Luis Fernando Barrera
[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Fri, 29 Sep 2000 21:10:45 -0400

>of the outlook client (for example) in clear text...

You would need to have a mail client that knows how to encrypt the 
connection (as well as an encrypting POP server). I seem to remember that 
there's some mail readers that can use POP-over-SSL to encrypt the 
connection; that's probably worth investigating.

>purpose is not to encrypt the user/password.

APOP replaces the password authentication with a challenge-response 
mechanism. Thus, the password isn't sent over the wire - it's used to hash 
a challenge. APOP is far better than standard POP because the password 
isn't sent in the clear; it's still subject to a dictionary attack against 
the password (if you can sniff the challenge and the response, you can 
brute-force the password).
         -Rick