I'm setting up my own personal mail server as big tech companies are getting evil each year. I find the username-password method archaic and insecure for something as important as email. What are my options? I like the concept of "access keys" from Amazon IAM. I also don't mind using PKI for email settings. The point I'm making here is that I want something that's not brute-forcible while revocable in case something goes wrong just like CRL. I know that IMAP is flexible because it supports SASL+GSSAPI, but the question is whether there are implementations I could use on my Android/IOS phones and PCs.


If we take Dovecot as example, below are the supported authentication mechanisms: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/

I think nowadays multi factor authentication and/or OTP offer better security compared to password login (regardless of the password storage backend). For example OTP and SKEY, OAUTBEARER or XOAUTH2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.