What should I know about security and IMP?
Imp is fairly secure. It is not completely secure; any system that claims
to be completely secure is holding a rather large foot near its mouth.
However, I can say that IMP is more secure than many applications that you
may use daily, such as telnet. The precautions taken in IMP include:
- Use of a secure web server
- Reasonable use of cookies
What does this mean?
Secure Web Server
Every piece of data - including your username and password, as well as
the text of all of your emails - is encrypted before being sent between your
web browser and the server that IMP runs on. This is done via SSL, a widely
available, commercially used system that uses public/private key
cryptography from RSA Data Security.
Does this mean that no one can read it? Realistically, no. For one thing,
IMP uses IMAP (Internet Mail Access Protocol) to achieve independence from
the server the mail sits on. IMAP is a fundamentally insecure system,
because none of its transactions are encrypted. So your username, password,
and email all have to travel between your mail server and IMP.
However, this is no different from any other way you might choose to read
your mail, unless you use SSH to login to your mail host (if you do, good
for you!). POP3, the other major protocol for retrieving mail over the
internet, suffers from the same insecurity.
So SSL encryption essentially makes IMP a toss up security-wise. It is no
more secure than other common ways of reading mail, but its use of the World
Wide Web does not make it any less secure.
Note: if your IMAP server runs on the same server that IMP does, or if
the IMAP server is on a switched connection to the web server that IMP runs
on, IMP will be about as secure as any unencrypted network transaction will
get. This is because data only has to travel to the loopback or along a
dedicated connection; thus only the (supposedly trusted) systems
administrators would have the priviledges to monitor this traffic. These
conditions are met for both Colrain and WSO for the IMP installation at
Williams College.
Cookies
Yes, IMP uses cookies to store some of the data it needs to pass between
scripts - namely usernames and passwords. However, the cookies that IMP sets
are tagged such that they will never be sent over an insecure connection, so
you never need to worry about your password being sent clear text over http
- SSL takes care of the security of your cookies as well as the rest of the
http transaction.
IMP also sets cookies to expire within 15 minutes of being set, unless
they are refreshed. This can be a minor inconvenience, but means that if you
forget to log yourself out, the vulnerable period when another person could
walk up to your web browser and use the cache and the already set cookies to
read your mail is fairly slim.
Finally, the cookies that IMP sets do not contain your actual username
and password - they contain a scrambled, unrecognizable version of them.
Note that they are NOT encrypted, and this scrambling should not be
regarded as a serious security feature. It is solely for cases like when you
have cookies set to verify before accepting, which can cause the contents to
be displayed on your screen. In a case like this, if your were showing IMP
to someone, you would not want your cleartext password displayed on the
screen. The scrambling feature remedies this and similar situations.
Conclusions
IMP is intended as a convenience and a pretty interface. It is not
intended for situations where utmost security is needed, and I, the creator
of IMP, will not be held liable for security breaches that occur, directly
or indirectly, through its use.
I hope you enjoy it.
-Chuck Hagenbuch.
|