ssl - Emacs wanderlust IMAP password authentication -
In emacs / wanderlust, if someone selects the 'clear' method of sending the password, but SSL enables for IMAP, is the password protected by SSL encryption? Specifically, the worrisome information is generated from the following paragraph in the manual:
There are two ways to use SSL, to start SSL communication only after a connection connection (normal methods) Second, In each session, start the SSL conversation using the STARTTLS command.
What is the first method to transmit passwords before or after SSL encryption? If first, the second (STARTTLS based) method ensures encrypted password transmission?
The password is safe, the difference between the two methods.
The difference between these approaches is in another aspect: the first step starts immediately after a TLS connection TCP handshake, and before Any IMAP exchange starts. Therefore, it uses a different port compared to regular IAPAPs, but can be used with the IAPAP servers, that their traffic is not only TLS support built through tunnels.
With the second method, for regular IMAP ports and an unencrypted IMAP exchange, however, before sending any credentials or any other personal data, this server should upgrade the connection to a TLS connection , And only starts the IMAP exchange (including password transfer) after This upgrade succeeded, this method allows encrypted IMAP from the default IMAP port, This is an IMAP server that can handle this IMAP protocol extension.
Nowadays, most servers support STARTTLS, so both methods are mostly equivalent to whatever Wanderlust uses as default.
Comments
Post a Comment