Outlook Express IMAP setup

[benjie]

Is the log in Username and Password sent in clear text when logging on to Gmail from Outlook Express? I'm asking because during the setup you have to leave "Log on using Secure Password Authentication" unchecked.

[CyberSmurf]

I'm not an expert, but I think that since you are using an SSL connection, your username and the password are encrypted.
http://en.wikipedia.org/wiki/Transport_Layer_Security

[ReuvenNY]

Thunderbird, a competing email client from Mozilla, does it automatically for you. Just indicate you are creating a Gmail account.

[benjie]

On the email client side the SSL is set up only for sending and receiving emails. It doesn't seem to have any encryption for Logging on.

[CyberSmurf]

Are you sure about that?

As far as I know, SSL encrypts all transmissions. That includes usernames and passwords. I've searched and can't find anything to the contrary.

Secure Socket Layer (SSL) refers to the standard method for encryption and authentication on the Internet. [provider name] supports encrypted password connections for email clients. This added security provides you with protection against having your password stolen on an insecure connection.

Currently when checking email your computer sends your username and password in clear text, which means that a person could intercept your password and use it for nefarious purposes. The first step to eliminate this security issue occurred several years ago, when Information Services enabled a feature (SSL) that encrypts your password. (Technically, it encrypts the entire POP or IMAP session.)

As far as I know, SPA (NTLM) is just another protocol. Leaving it unchecked does not inhibit password encryption in SSL.

Microsoft's Exchange server provides an NTLM authentication mechanism for the POP3 protocol. This is a proprietary extension used with the POP3 AUTH command as documented in RFC 1734. On the client side, this mechanism is supported by Outlook and Outlook Express, and is called "Secure Password Authentication".

[CyberSmurf]

"proprietary". I guess that's why the option doesn't appear in my other e-mail clients.

[CyberSmurf]

Thunderbird supports GSSAPI, Kerberos, CRAM_MD5, DIGEST-MD5, NTLM, and APOP. NTLM is also called Secure Password Authentication (SPA) or Windows Integrated Login.

http://kb.mozillazine.org/Connection_errors_-_POP3

[popowich]

SSL is always encrypted. TLS starts unencrypted.

A hashed form of your username/password is used when authenticating over TLS.

-Raymond