227560 - Unable to use plaintext-only authentication with IMAP (Server has broken CRAM MD5 Support)

Status: RESOLVED DUPLICATE of bug 231303

(Thunderbird :: Account Manager, defect)

Description

[Robert Casties]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6b) Gecko/20031202 Firebird/0.7+
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.6b) Gecko/20031202 Firebird/0.7+

With the Thunderbird builds after 1119 I am unable to connect to a Quickmail Pro
Server via IMAP. With the earlier builds this was no problem.

The underlying problem is that Quickmails CRAM-MD5 support is badly broken. It
advertises CRAM-MD5, but when you try to use it, you get an error and it is no
longer possible to login even with PLAIN authentication.

The earlier builds use only PLAIN authentication when "use secure
authentication" is unchecked even if the server advertises CRAM. This behaviour
should be reinstated or there should be least a hidden config option for silly
servers.


Reproducible: Always

Steps to Reproduce:
1. Uncheck "use secure authentication"
2. Connect to Quickmail Pro Server via IMAP

Actual Results:  
Message "Login to server failed" (behind the scenes Thunderbird tries to
authenticate using CRAM-MD5 at first).
Login is impossible.

Expected Results:  
Logged in (using PLAIN authentication).

Comment 1

[Scott MacGregor]

lorenzo, does the fix for 225809 play a role in this bug? cc'ing 

Comment 2

[Lorenzo Colitti]

Yes, this is probably caused by the fix to bug 225809. If I understand it
correcly, it's not our fault. :-( Reporter, can you attach an IMAP log so I can
figure out what's going on?

What we can do:

1. Don't use CRAM-MD5 at all unless the user explicitly turns on secure auth.
2. Create a hidden pref that "the server is broken, don't try CRAM-MD5".
3. Change the pref from a boolean to an integer. 0=use plaintext, 1=try cram and
fall back, 2 use cram only

#1 hurts security, #2 adds bloat, and #3 requires us to migrate the pref.
mscott, what do you think?

Comment 3

[Christian Eyrich]

Lorenzo, such bloody servers where the reason why POP3 does like it does:
CRAM-MD5 only when secure switched on. We fought long and tried workarounds
before switching to the current behaviour.

#2 would be the best (from security) what we can do. But who want to tell all
the users to set the pref because ... particularly because not all users call us.
#3 also adds bloat and presumes the user knows what's going on (or somebody
tells him).

Comment 4

[Scott MacGregor]

Sounds like we don't have traction on a quick fix. I'm going to ship 0.4 with
this since I am minutes away frm pushing bits and we don't have a fix yet. We'll
try to figure something out for 0.5.

Comment 5

[Robert Casties]

Attachment: Partial tcpdump of failed IMAP login

Here's a partial tcpdump of a failed IMAP login attempt with Thunderbird RC2 to
our Quickmail Pro Server. I left out packets that seemed to be ACK only.

Comment 6

[Robert Casties]

> What we can do:
> 
> 1. Don't use CRAM-MD5 at all unless the user explicitly turns on secure auth.
> 2. Create a hidden pref that "the server is broken, don't try CRAM-MD5".
> 3. Change the pref from a boolean to an integer. 0=use plaintext, 1=try cram
and fall back, 2 use cram only

I'd like a behaviour like #1 where "use secure auth" would be the default and
this option means it's CRAM-MD only and when unchecked means PLAIN only.

Comment 7

[Lorenzo Colitti]

Re comment #5: that's pathetic! This server is seriously broken. Have you tried
to report this and/or upgrade the server to a new version?

Comment 8

[Lorenzo Colitti]

mscott, what do you say? #1 should be virtually zero work, I think.

Comment 9

[Robert Casties]

Re comment #7: As far as I know this (3.0.2) is the latest version of Quickmail
Pro Server. I cannot reach our mail-master now to ask him to file a bug with
Quickmail.

Still, I think it should be possible to use Thunderbird in the presence of
broken mail servers (like ours).

Comment 10

[Lorenzo Colitti]

Duping to bug 231303 instead of the other way since that one has a patch.

*** This bug has been marked as a duplicate of 231303 ***

Comment 11

[Ben Bucksch (:BenB)]

Outspring <http://www.outspring.com> has discontinued QuickMail on 2008-07-25.