<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">Agree with everything Bill said here…especially “…unwisely run organizations drinking vendor Kool-Aid…”</p>
<p dir="auto">The better solution is using OAuth2 which I believe is supported in many IMAP servers such as Dovecot.</p>
<p dir="auto">With that in mind, seems like the big boys are creating a somewhat false sense of urgency - what we typically called “FUD” in my SE days - so as to peddle more of that Kool-Aid referenced above…</p>
<hr style="background:#333; background-image:linear-gradient(to right, #ccc, #333, #ccc); border:0; height:1px" height="1">
<p dir="auto">On 24 Jun 2021, at 20:21, Bill Cole wrote:</p>
</div>
<div style="white-space:normal"><blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">On 2021-06-24 at 20:35:55 UTC-0400 (Thu, 24 Jun 2021 17:35:55 -0700)<br>
Harvey Leff <mailmate@lists.freron.com><br>
is rumored to have said:<br>
</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">I had written earlier that my email provider (the university from which I retired) stopped using IMAP, which would rule out use of MailMate. They also stopped having a "Forward all mail" option so I cannot move my mail to an IMAP-enabled site. I've complained, and the response is below. I switched (with great difficulty) to gmail, which of course uses IMAP and allows me to continue my love affair with MailMate.<br>
<br>
It seems that a prime alleged reason for their change is that IMAP does not support 2-Factor authentication. Do any of you experts have knowledge whether that claim is true and really limits security?</p>
</blockquote><p dir="auto">IMAP has no direct support for any form of 2FA because the way IMAP is used typically involves multiple short-term authenticated sessions with no persistent shared state across them. If you did 2FA directly in IMAP with something like a code sent by SMS or generated by a TOTP device or app (e.g. Google Authenticator or Duo,) you'd be re-authenticating every few minutes, because IMAP does not have any equivalent to HTTP cookies.<br>
<br>
Some IMAP servers and clients (including MailMate) support an authentication protocol called OAuth2, which delegates the authentication to an external web-based protocol which generates renewable access tokens that a client like MailMate can use for authentication. OAuth2 token providers typically require 2FA. MailMate uses OAuth2 to access GMail accounts via IMAP.<br>
</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">They are now implementing 2FA using a seemingly complicated system called Duo. Anybody know about that type of 2FA?</p>
</blockquote><p dir="auto">Duo is a brand name for a proprietary 2FA system sold by Cisco Systems. It does not directly support OAuth2 and as a proprietary system there is no open standard for integrating it into IMAP (or POP or SMTP.) It does work with Office365, and Office365 supposedly can be an OAuth2 provider. I can't confirm that.<br>
</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">The university's reply is below if you are interested and willing to read the claims. What I **DO** know is that the university replaced its standard IMAP/SMTP server with Microsoft's proprietary ActiveSync.</p>
</blockquote><p dir="auto">Cisco and Microsoft share an interest in selling proprietary software that shuts out 3rd-party tools.<br>
</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">Beware, this might be an indicator of the future… Yikes!</p>
</blockquote><p dir="auto">I've heard that about Microsoft and email software before. I don't think there's really anything to worry about in a universal sense, just a substantial number of unwisely run organizations drinking vendor Kool-Aid.<br>
<br>
I can neither confirm or refute your university's assertions about what Microsoft's Office365 IMAP service can support. I can say what MM sees when it connects:<br>
</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">02:44:43 Trying to connect to outlook.office365.com on port 993 (CFNetwork) without STARTTLS (required)<br>
02:44:43 Resolved hostname (outlook.office365.com).<br>
02:44:43 Prepare secure connection...<br>
02:44:43 Successful connection.<br>
02:44:43 Initiating secure connection...<br>
02:44:43 Returned (4)...<br>
02:44:43 Protocol version: kTLSProtocol12<br>
02:44:43 S: * OK The Microsoft Exchange IMAP4 service is ready. [QwBIADIAUABSADEANQBDAEEAMAAwADEAMwAuAG4AYQBtAHAAcgBkADEANQAuAHAAcgBvAGQALgBvAHUAdABsAG8AbwBrAC4AYwBvAG0A]<br>
02:44:43 C: A0 CAPABILITY<br>
02:44:43 S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=PLAIN AUTH=XOAUTH2 SASL-IR UIDPLUS ID UNSELECT CHILDREN IDLE NAMESPACE LITERAL+<br>
02:44:43 S: A0 OK CAPABILITY completed.</p>
</blockquote><p dir="auto">The "AUTH=XOAUTH2" bit there in the server's response to the IMAP CAPABILITY command indicates support for the standard mechanism by which IMAP can support OAuth2, potentially backed by 2FA of some flavor. Whether that works, I can't say. Whether it can be made to work with Duo as the specific 2FA solution, I cannot say. It is interesting that MailMate does not use OAuth2 with Microsoft or Yahoo accounts, even though both advertise support in their CAPABILITY replies.<br>
<br>
-- <br>
Bill Cole<br>
bill@scconsult.com or billcole@apache.org<br>
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)<br>
Not Currently Available For Hire<br>
_______________________________________________<br>
mailmate mailing list<br>
mailmate@lists.freron.com<br>
<a href="https://lists.freron.com/listinfo/mailmate" style="color:#777">https://lists.freron.com/listinfo/mailmate</a></p>
</blockquote></div>
<div style="white-space:normal">
</div>
</div>
</body>
</html>