<html><head><style id="outgoing-font-settings">#response_container_BBPPID{font-family: initial;font-size: initial;color: initial;}</style></head><body style="background-color: rgb(255, 255, 255); background-image: initial; line-height: initial;"><div id="response_container_BBPPID" style="outline:none" dir="auto" contenteditable="false"> <div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">It seems to me that Oauth weakens security. You allow some other system into your system. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">Are you running your own email server? I see you are using Gmail for the listserv.</div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">If you run your own server there are other steps I would take first other than MFA, though MFA would be the best. Geofencing alone reduces the attack pathways. </div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">My server is set up so only 25 sees the entire internet. All other email ports are behind a geofence and a rather large blocking list I have built up over the years of VPS, hosting companies, etc. I'm using 587.</div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%"><br></div><div id="BB10_response_div_BBPPID" dir="auto" style="width:100%">I see very little attempts to hack my email server. If I wanted to go the next level up I would use fail2ban. But that would be to cut down chatter in the log file. No bot or person is going to crack my password. It is high entropy. Server passwords are not in clear text. </div> <div id="response_div_spacer_BBPPID" dir="auto" style="width:100%"> <br></div> <div id="blackberry_signature_BBPPID" dir="auto"> <div id="_signaturePlaceholder_BBPPID" dir="auto"></div> </div></div><div id="_original_msg_header_BBPPID" dir="auto"> <table id="_pHCWrapper_BBPPID" width="100%" style="border-spacing:0px;display:table;outline:none" contenteditable="false"><tbody><tr><td colspan="2"> <div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb( 181 , 196 , 223 );padding:3pt 0in 0in;font-family:'tahoma' , 'bb alpha sans' , 'slate pro';font-size:10pt"> <div id="from"><b>From:</b> montneytyler@gmail.com</div><div id="sent"><b>Sent:</b> November 13, 2021 1:16 PM</div><div id="to"><b>To:</b> dovecot@dovecot.org</div><div id="subject"><b>Subject:</b> Strategies for protecting IMAP (e.g. MFA)</div></div></td></tr></tbody></table> <br> </div><div dir="auto" style="outline:none" contenteditable="false"><div dir="auto">With the world of ransomware as it is today (aka attacks seem more vicious and commonplace), anything I expose to WAN must have additional protection. I've seen a few posts to this list on it. The only thing that helped was that Dovecot supports OAuth. Through OAuth I figure I could implement MFA. However, I'd have to host my own identity server. From there, Thunderbird supports OAuth so that should work.<div dir="auto"><br></div><div dir="auto">Since this is getting increasingly complicated, I wanted to ask before going further. What do you all do? Any recommendations?</div></div>
</div></body></html>