With plain-text sign-in turned off, POP3 refused USER, PASS, APOP and
AUTH PLAIN on an unencrypted connection, but still offered and
accepted AUTH OAUTHBEARER and AUTH XOAUTH2. A client would send its
bearer token in the clear, where anyone on the network path could read
it and use it until it expired.
Every AUTH mechanism now follows the plain-text setting, as in IMAP and
ManageSieve, and CAPA offers no mechanism on a clear-text connection
where none would be accepted.
Test: on a clear-text connection with plain-text sign-in off, CAPA
listed "SASL OAUTHBEARER XOAUTH2" on main; it lists none now, and AUTH
OAUTHBEARER, XOAUTH2 and PLAIN are each refused.
jcoffey-dev
905b018ce6