Software Development:
Individual Programming

 

Solution

What is SPA and do I need it?

SPA stands for "Secure Password Authentication" and was originally developed by Microsoft for the encrypted transmission of passwords from MS Outlook to Microsoft Exchange Server, because at that time the connection between workstation computers and the company's MS Exchange Server (the mail server ) was usually unencrypted. In the configuration of a mailbox in MS Outlook you will find, among other things, the checkbox "Login using secure password authentication (SPA) ". Only later were servers relocated to the Internet, so that the entire connection had to be encrypted and additional password encryption was unnecessary.

Some users believe that it is a good idea to encrypt the password for logging in to a mailbox. However, the connection between your MS Outlook and the mail server is already encrypted, so it is actually useless to also encrypt the password within an already encrypted connection. Furthermore, SPA was developed by Microsoft for use with MS Exchange servers and not for use with Linux mail servers. Therefore, SPA has a few pitfalls in connection with Linux.

You can use SPA in connection with your Bitpalace mailbox, although this is not an MS Exchange mailbox, because SPA uses common password encryption algorithms, e.g. DIGEST-MD5, CHALLENGE-MD5, to encrypt a password. But: In the event of technical changes, e.g. upgrades to the algorithm or the algorithms made available on the server, MS Outlook does not automatically adapt the encryption method to the new requirements of the mail server. It is therefore possible that the connection to mailboxes in which you have activated SPA suddenly fails.

Bitpalace recommends not using SPA in connection with your mailbox in your Bitpalace web space. You are already using connection encryption (SSL/TLS) between your mail program and the server. This means that all data is reliably encrypted - including the login data. It therefore makes little sense to also encrypt the password within an already encrypted connection. The additional encryption has no advantage for you, but often leads to problems with later changes.

 

Overview of frequently asked questions