What should I know about security and IMP?

Imp is fairly secure. It is not completely secure; any system that claims to be completely secure is holding a rather large foot near its mouth. However, I can say that IMP is more secure than many applications that you may use daily, such as telnet. The precautions taken in IMP include:

  • Use of a secure web server
  • Reasonable use of cookies

What does this mean?

Secure Web Server

Every piece of data - including your username and password, as well as the text of all of your emails - is encrypted before being sent between your web browser and the server that IMP runs on. This is done via SSL, a widely available, commercially used system that uses public/private key cryptography from RSA Data Security.

Does this mean that no one can read it? Realistically, no. For one thing, IMP uses IMAP (Internet Mail Access Protocol) to achieve independence from the server the mail sits on. IMAP is a fundamentally insecure system, because none of its transactions are encrypted. So your username, password, and email all have to travel between your mail server and IMP.

However, this is no different from any other way you might choose to read your mail, unless you use SSH to login to your mail host (if you do, good for you!). POP3, the other major protocol for retrieving mail over the internet, suffers from the same insecurity.

So SSL encryption essentially makes IMP a toss up security-wise. It is no more secure than other common ways of reading mail, but its use of the World Wide Web does not make it any less secure.

Note: if your IMAP server runs on the same server that IMP does, or if the IMAP server is on a switched connection to the web server that IMP runs on, IMP will be about as secure as any unencrypted network transaction will get. This is because data only has to travel to the loopback or along a dedicated connection; thus only the (supposedly trusted) systems administrators would have the priviledges to monitor this traffic. These conditions are met for both Colrain and WSO for the IMP installation at Williams College.

Cookies

Yes, IMP uses cookies to store some of the data it needs to pass between scripts - namely usernames and passwords. However, the cookies that IMP sets are tagged such that they will never be sent over an insecure connection, so you never need to worry about your password being sent clear text over http - SSL takes care of the security of your cookies as well as the rest of the http transaction.

IMP also sets cookies to expire within 15 minutes of being set, unless they are refreshed. This can be a minor inconvenience, but means that if you forget to log yourself out, the vulnerable period when another person could walk up to your web browser and use the cache and the already set cookies to read your mail is fairly slim.

Finally, the cookies that IMP sets do not contain your actual username and password - they contain a scrambled, unrecognizable version of them. Note that they are NOT encrypted, and this scrambling should not be regarded as a serious security feature. It is solely for cases like when you have cookies set to verify before accepting, which can cause the contents to be displayed on your screen. In a case like this, if your were showing IMP to someone, you would not want your cleartext password displayed on the screen. The scrambling feature remedies this and similar situations.

Conclusions

IMP is intended as a convenience and a pretty interface. It is not intended for situations where utmost security is needed, and I, the creator of IMP, will not be held liable for security breaches that occur, directly or indirectly, through its use.

I hope you enjoy it.

-Chuck Hagenbuch.