Security Flaw with e-Mail Client

[catfelix17]

I was having trouble setting up SSL on a POP3 account using the default e-mail client that comes with the Droid Incredible.  I contacted your customer service and was told that the e-mail client does not allow SSL on a POP3 account unless it is required by the server.  The rep also told me that there are no plans to fix this and that I have to live with it.  To me this is a major security issue because one of the main reasons to use a "smart" phone such as the Incredible is for e-mail and if you cannot secure the transmission between the device and your e-mail server, it make this feature pretty much useless.

Do you have any comments on this?

[budone]

In most all situations and ISP's you must use an SSL or IMAP setting for outgoing. (And without looking I think port 587) Incoming is set up the same as your home service. No need for an SSL setting.

Also your mobile mail server may be different than your home service.

For example my home service is mail.charter.net

On my mobile I HAVE to use mobile.charter.net.

Investigate online for your particular ISP for mobile settings.

[catfelix17]

budone, thanks for the reply, but the issue is not with my mail server, it is strictly with the e-mail client.  The reason I say this is because I've tested SSL with POP3 with two other clients (K-9 and DroidMail) and they work fine.  The difference with those other clients is that they will use SSL whether or not the server requires it.  The default e-mail client, on the other hand, will only use SSL if the server requires it.  I'm not crazy about K-9 or DroidMail, but am using them because of the SSL feature.

[budone]

Are you speaking of the email program provided on here?? I am kind of lost. That is the sad part about posting, it can be read so many different ways by many people. 

Or are you are saying the client you use does not use SSL security??? If that is the case, then that is not a Verizon issue. The Incredible allows an SSL or IMAP set up for clients that require it. (Heck I thought all did if you wanted to access their system from an outside source)

I will leave some info below. I will check back later and if you can give a better detail, I (or someone else) will be able to get this figured out for you.

Later.....

When you set up an email account, do it manually.

The first settings is for incoming,

Click mail, more, New account

Choose Pop3/IMAP

Enter your email address and password you use currently. Choose manual setup.

Scroll down and enter your incoming server ( ie mail.charter.net  for me) leave security set to none and leave the port number alone and choose NEXT

Next screen Checkmark LOGIN REQUIRED. Enter the correct outgoing Server setting. For me it is mobile.charter.net. (I would first try your current outgoing mail server you currently use on your computer)

Security type choose SSL

Port 587

Save

[catfelix17]

Understood.  Let me clarify:

The default e-mail client that comes with the Incredible DOES allow you to use SSL as an option when setting up a POP3 account.  Acutally, you have three options (None, SSL and TLS). 

When you setup a POP3 account, you need a few pieces of information; email account, password, incoming/outgoing server, etc. 

As you setup an account, the first settings you need to configure are the Incoming Mail server.  If you select NONE as the security option, everything works fine and you are taken to the Outgoing Mail server settings screen.  However, if you select SSL as the security option when setting up the Incoming Mail server, you can't get past that screen and you'll keep going back to the Incoming Mail server settings screen.

The VZW tech told me that the only way to enable SSL is "if the server requires it."  If the server does not require SSL, for example it gives you the choice of using it or not, the mail client won't work.  To me, having the server force you to use SSL is not the answer.  The choice should be on the client's side.

[budone]

Alright I understand now. I could set up my phone to use SSL through Charter, but I never have.

I know Charter requires for me to send mail through their servers from my phone.

Sorry I can not help more.

UPDATE   I thought about this a bit more. Charter and most others require an SSL connection to keep issues off their side when we send through them.

We never send anything through Verizon, they shut down that server maybe two years ago. So I can understand why it is not required on their end.