[GH-ISSUE #1029] Request for information: "Plain text" #820

New issue

Open

opened 2026-02-26 01:32:00 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 01:32:00 +03:00

Owner

Originally created by @GregoryTravis on GitHub (Jul 24, 2020).
Original GitHub issue: https://github.com/jberkel/sms-backup-plus/issues/1029

Originally assigned to: @kurahaupo on GitHub.

The README says:

change Authentication to "Plain text" in "Advanced settings - Custom IMAP server"

Does "plain text" here mean that it is sending the app password unencrypted?

Originally created by @GregoryTravis on GitHub (Jul 24, 2020). Original GitHub issue: https://github.com/jberkel/sms-backup-plus/issues/1029 Originally assigned to: @kurahaupo on GitHub. The README says: change Authentication to "Plain text" in "Advanced settings - Custom IMAP server" Does "plain text" here mean that it is sending the app password unencrypted?

kerem added the

question

helpful

labels

2026-02-26 01:32:00 +03:00

kerem commented

2026-02-26 01:32:00 +03:00

Author

Owner

@Tecfan commented on GitHub (Aug 22, 2020):

I would also like a more in-depth explanation what happens to our "unencrypted" passwords.

@Tecfan commented on GitHub (Aug 22, 2020): I would also like a more in-depth explanation what happens to our "unencrypted" passwords.

kerem commented

2026-02-26 01:32:00 +03:00

Author

Owner

@ajhepple commented on GitHub (Aug 22, 2020):

As I understand it, the IMAP protocol is conducted in plain text, including the password, but the whole thing is encapsulated by a TLS session which is encrypted. The email client need not encrypt data because the connection is secure, thanks to TLS.

I've often been known to misunderstand things!

@ajhepple commented on GitHub (Aug 22, 2020): As I understand it, the IMAP protocol is conducted in plain text, including the password, but the whole thing is encapsulated by a TLS session which is encrypted. The email client need not encrypt data because the connection is secure, thanks to TLS. I've often been known to misunderstand things!

kerem commented

2026-02-26 01:32:00 +03:00

Author

Owner

@kurahaupo commented on GitHub (Aug 23, 2020):

@ajhepple is correct. It's not especially vulnerable to interception as long as the IMAP server you're talking to supports and requires encryption. (GMail IMAP does.)

In this context "plain text" means that that the password itself is sent, rather than being used as part of a key-exchange.
The is a requirement to support the IMAP protocol, which is 30+ years old at this point.

Together with the requirement to make the unencrypted password visible to any app that uses it, these are reasons why you should have a unique password for IMAP (or POP) access.

@kurahaupo commented on GitHub (Aug 23, 2020): @ajhepple is correct. It's not especially vulnerable to interception as long as the IMAP server you're talking to supports and requires encryption. (GMail IMAP does.) In this context "plain text" means that that the password itself is sent, rather than being used as part of a key-exchange. The is a requirement to support the IMAP protocol, which is 30+ years old at this point. Together with the requirement to make the unencrypted password visible to any app that uses it, these are reasons why you should have a unique password for IMAP (or POP) access.