Subject: Re: pop-gw encrypted?

From: Frederick M Avolio <[email-masked]>
Date: Fri, 29 Sep 2000 19:32:56 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

At 02:51 PM 9/29/00 -0600, Luis Fernando Barrera wrote:
 >[To be removed from this list send the message "unsubscribe fwtk-users" in the
 >BODY of a mail message to [email-masked].]
 >
 >Hi,
 >
 >Is there a way to encrypt the connection between some external user
 >and the pop-gw of the FWTK? Thus, not sending the user/password
 >of the outlook client (for example) in clear text...
 >
 >I've seen an option of the pop-gw called APOP, but I understant that its
 >purpose is not to encrypt the user/password.
 >As far as I know the POP3 protocol itself sends the user/password in clear 
 >text...

APOP does not send the password in the clear. Instead, it sends a random 
string of data in the clear. The client side, catenates the random string 
onto the password, makes an MD5 cryptographic hash of it, and sends that 
hash value in the clear. The server has the user's password and does the 
same. If the hash values match, the password was correct.

This is not directly susceptible to an eavesdropping attack, but is to a 
brute force attack or a poorly chosen password.

Fred
Avolio Consulting, Inc.
16228 Frederick Road, PO Box 609, Lisbon, MD 21765, US
+1 410-309-6910 (voice)	+1 410-309-6911 (fax)
http://www.avolio.com/

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 2 Oct 2000 11:43:11 -0400

On Fri, Sep 29, 2000 at 09:10:45PM -0400, Rick Murphy wrote:
...
> You would need to have a mail client that knows how to encrypt the 
> connection (as well as an encrypting POP server). I seem to remember that 
> there's some mail readers that can use POP-over-SSL to encrypt the 
> connection; that's probably worth investigating.

I wasn't sure whether I remembered that or not ... but if there is,
it's probably Eudora.

> APOP replaces the password authentication with a challenge-response 
> mechanism. Thus, the password isn't sent over the wire - it's used to hash 
> a challenge. APOP is far better than standard POP because the password 
> isn't sent in the clear; it's still subject to a dictionary attack against 
> the password (if you can sniff the challenge and the response, you can 
> brute-force the password).

But it's pretty hard, no?

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 2 Oct 2000 11:35:52 -0400

On Fri, Sep 29, 2000 at 02:51:42PM -0600, Luis Fernando Barrera wrote:
 > As far as I know the POP3 protocol itself sends the user/password in clear text...
 > 
 > Luis Fernando Barrera
 > [email-masked] 

This has been discussed on the qpopper mailing list.  I believe that
the best suggestion was to use ssh between client and host.

---

From: dreamwvr <[email-masked]>
Date: Mon, 2 Oct 2000 11:52:13 -0600

hi,
   yes eudora but make sure it is a patched version as there was a nasty bug
some time ago..
as well layer it with stunnel that way there are 2 crypt factors to overcome..
on the  connection besides good passwords. as we all know well if the passwords 
are no good well then it is all mute.. 
				Best Regards,
				[email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Mon, 02 Oct 2000 18:41:24 -0400

At 11:43 AM 10/2/00 -0400, Joseph S D Yao wrote:
> > APOP is far better than standard POP because the password

Hard in that a true brute-force is going to take a lot of CPU cycles. 
Pretty easy to code; given targeted guesses and/or bad password choices it 
could be a very quick crack.
Don't get me wrong - APOP is far better than clear-text auth.
         -Rick