activ8's dodgy imap based mailserver

[wotnot]

A tale of caution more or less.

I did a windows7->linux migration today for a local resident ; they'd chosen Kmail as their default email client, and I was help entering the user's ISP provided emailbox credentials.

Kmail's reasonably adept at doing most of this by itself, via simple smtp chat sessions ; all it needs to know is the mailserver name and it deduces most of the config requirements easily enough.

However, in the case of mail.activ8.net.au the configuration wizard comes back screaming blue murder (in bold red letters =), that it's found the mailserver is using unsecured imap, and data/connection is not SSL/TLS encrypted.

I've got the new linux user doing this, they think they've done something wrong, but I'm there to explain to them it isn't them -- it's their ISP.

Out of curiosity I didst ping mail.activ8.net.au to discover 64 bytes from coldstandby.activ8.net.au ....there's an oxymoron of a server name if ever I saw one =) It also redirects to webmail.activ8.net.au on port 80.

It's difficult to make many folks understand the security risks of having an email system setup like that, except for perhaps 'form a mental picture of every form or letter you've sent through austpost, possibly being opened and read by someone else'.

The resolution of choice for today, was to quickly setup a gmx.com email account for them, with the 'as per usual' email client config of receive from old activ8 mail server & gmx, send via gmx mail server only to restamp return to field, and match the email account descriptors in gmx setup so nobody knows you've change email address, and you don't need to tell them this, and whenever later you see the machine again, you set send/receive to gmx, and forget about activ8's email service altogether.

Having been sys-admin & 'post-master' (person responsible for the mailserver) for a number of ISPs back in the 90's, I would...as Kmail rightfully alerts the user to during setup...highly discourage the use of activ8.net.au's mailserver in it's current configuration.

Be careful out there =)