So am I. From looking at http://jmap.io/spec.html#authentication, it looks like the password will be transmitted in plain text. (See the text below the 200 response)
That makes me extremely queasy. Yes, HTTPS theoretically provides transport layer security, but a single breach of transport layer security results in the attackers permanent access to your mail.
I.e. run a MITM attack in a coffee shop, snoop up JMAP passwords, make use of them at a latter point in time.
I really hope I'm missing something important, or misread the spec.
That makes me extremely queasy. Yes, HTTPS theoretically provides transport layer security, but a single breach of transport layer security results in the attackers permanent access to your mail.
I.e. run a MITM attack in a coffee shop, snoop up JMAP passwords, make use of them at a latter point in time.
I really hope I'm missing something important, or misread the spec.