Email Settings That Send Passwords in Plain Text

A password sent every few minutes

A phone set up to collect business email signs in to the mail server every few minutes. Each time, it sends the mailbox name and password.

If the account was set up without encryption, that password travels in readable form. At the office it crosses your own network. In a coffee shop, a hotel or a trade show hall, it crosses one shared with strangers.

Many phones and copies of Outlook were set up this way years ago, because the host's instructions said so or because the secure option produced a warning.

Nothing seems wrong, because the mail works. The problem stays invisible until someone else uses the password.

Signs your settings are the old ones

• Incoming mail on port 110 or 143, with SSL switched off.
• Outgoing mail on port 25, with no encryption selected.
• An encryption setting marked none, or a box left unticked.
• A setup done years ago by someone who has moved on.
• A certificate warning that someone once made go away.

The fifth explains a great many accounts. Someone tried the secure option, saw a warning about the certificate, and switched encryption off because the plain setting worked.

What crosses the network

Collecting mail and sending it are separate connections, and each one signs in. Unencrypted, both carry the password, and the messages themselves are readable too.

On an open network with no password, anyone nearby can record that traffic with free software. A network whose password is printed on every table protects little more, since everyone in the room has it.

There are also fake hotspots, named to look like the hotel's, which pass traffic through a stranger's laptop on its way to the internet.

The phone does not need to be in use for any of this. It checks the mailbox from a pocket, all day.

Why a mailbox password is worth stealing

Password reset links for the domain, the hosting, the social accounts and often the bank go to that mailbox. Whoever can read it can reset the rest.

The mailbox can also send spam under your name, which gets your mail blocked by other servers, so customers stop receiving your replies.

And it can be used to send your customers a convincing invoice, from your real address, with new bank details on it.

Finding your host's secure settings

Many hosting control panels have an email setup page listing two sets of settings side by side, one marked secure and one marked not recommended. Use the first.

Note the exact server name. A secure connection relies on a certificate issued for a particular name, often the host's own server rather than mail.yourdomain.ca, and using a different name is what produces the warning.

If the page is unclear, ask the host for the secure server name and port for incoming mail, the same for outgoing mail, and whether outgoing mail needs a password.

A worked example

An adventure race organiser runs four races a year, combining trail running, mountain biking and paddling, and spends much of the season at race sites, in motels and at outdoor expos promoting the next event.

The phone and laptop that collect the business's email were set up six years ago by the friend who built its first website, with the settings the host listed then: no encryption in either direction.

A week after a spring outdoor expo, racers began replying to messages the organiser had never sent, and the host suspended outgoing mail from the mailbox for sending spam.

Nobody can say where the password was taken. The settings meant it had crossed the expo's Wi-Fi and the motel's, readable, many times an hour for four days.

The repair took an hour with the host's setup page open. The phone, the laptop and an old tablet still checking the mailbox were moved to the secure settings, then the password was changed and entered once on each.

The host lifted the suspension once the spam stopped. The secure settings and the server name now sit with the business's other account records, ready for the next device.

Every device, both directions

Each phone, tablet and computer that collects the mail has its own copy of the settings. Find them all, including the old laptop at home and the tablet in a drawer.

On an iPhone, look under Mail, Contacts, Calendars, in the account's advanced options. On Android, look for the security type in the incoming and outgoing server settings. In Outlook, the encryption choices are in the account's advanced settings.

Change incoming and outgoing on each. Outgoing is the one people forget, and it signs in too.

Remove the mailbox entirely from any device nobody uses any more.

Then change the password

The password may already have crossed open Wi-Fi in readable form, so treat it as known. Change it once every device has the secure settings, not before.

The order matters. A device left on the old password keeps trying, and some servers block an address after repeated failed sign-ins.

Choose a long password used nowhere else, then enter it once on each device. If the old password was used anywhere else, change it there too.

Other logins that travel the same way

Webmail should open at an address starting with https. If it does not, ask the host for the secure address and bookmark that one.

Whoever updates your website by plain FTP sends that password readable as well. Most hosts offer an encrypted alternative, and it is worth asking for.

The counter-case

Office 365 and Google Apps for Work mailboxes already require encrypted connections, so this mostly concerns email provided with a hosting account.

A business whose mail is only ever read on the office network is less exposed. Phones travel, though, and most mailboxes are on one.

Some older hosting accounts offer no secure settings at all. That is a reason to ask for a better arrangement for your email, not to live with the plain ones.

For everyone else, the fix is secure settings on every device, in both directions, followed by a new password.

Before the next trip

1. Open the mail settings on every device.
2. Note the ports and encryption in use.
3. Get the secure settings from your host.
4. Update incoming and outgoing on each device.
5. Remove the mailbox from unused devices.
6. Change the password once all are done.
7. Check webmail and FTP addresses too.

Step six is the one that feels optional once the mail works. Secure settings protect only what is sent from now on, and a password that already crossed public Wi-Fi readable may be sitting in someone else's notes.

Old settings kept because they still work were also the problem in FREAK and the old encryption settings on your server.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.