News for hackers. Stuff that matters.

A comment on Tell HN: Fastmail is leaking internal routing email address/username with teams. Parent comment

Re:Tell HN: Fastmail is leaking internal routing email addre... by reilly3000 on Friday October 06, 2023 @06:42PM (#37797279)
Migadu and don’t look back
[ Parent | on HN ]
Re:Tell HN: Fastmail is leaking internal routing email addre... by k_roy on Saturday October 07, 2023 @10:51PM (#37807489)
This is a bit of an interesting take from: https://www.migadu.com/procon/

"We could enable 2FA on the webmail, but IMAP/POP/SMTP accesses remain unprotected which beats the purpose. We are working on solution here which will allow sand-boxing a username/password pair to a webmail use only."

That's an incredibly misguided sentiment

[ Parent | on HN ]
Re:Tell HN: Fastmail is leaking internal routing email addre... by dejan on Monday October 09, 2023 @04:41PM (#37825232)
Why?
[ Parent | on HN ]
Re:Tell HN: Fastmail is leaking internal routing email addre... by k_roy on Thursday October 12, 2023 @10:53PM (#37866027)
Because it's the difference between someone gaining access to a single mailbox versus the whole config.
[ Parent | on HN ]
Re:Tell HN: Fastmail is leaking internal routing email addre... by dejan on Monday October 16, 2023 @04:00AM (#37896937)
I think you're reading that wrong. It's an issue with the protocol. IMAP/SMTP as implemented in most clients do not support 2FA. You can add 2FA on your own on the webmail, but you could still circumvent it by using the protocol directly. It's not a Migadu-specific thing.
[ Parent | on HN ]