Re: APOP and qpopper2.4, how safe?

[daemond () ibm net]

-----------------------------------------------------------------------------
Spammers beware: I do not buy from companies that spam!
*****************************************************************************

On Tue, 9 Dec 1997, Dave Roberts wrote:

*->On Mon, 8 Dec 1997, Marc Goldburg wrote:
*->
*->> One option would be to have these people get accounts with local ISP's and
*->> then use APOP over the internet to retrieve their mail.  
Lost the original persons e-mail, but needed to ask this:
APOP uses an encrypted password, but does this change from session to
session?  If not then APOP is not really much more secure than regular POP
(since all a hacker needs to do to get a persons e-mail is to replay the
encrypted password).  The only upside I can see is that it denies a hacker
shell or ftp access using that persons account (provided that no one figures
out how to decrypt an encrypted APOP password).  

Geoff
daemond () ibm net