Writing a Secure POP3 Server

By now, most users are probably familiar with POP3, a simple post office protocol for retrieving email from a mail server, often over the Internet. But how do you protect your POP3 server against attacks? For starters, you need to consider the various security issues involved in creating a POP3 server. Part of writing secure code is designing secure code and considering security issues before you start. I can't reiterate enough the importance of proper design. Too many software projects don’t design for security from the ground up, and trying to add it later often results in large security holes or wasted effort ripping out systems and rewriting them.

Despite POP3's simplicity, a lot of security issues are worth examining. If you look in the archives of any good security mailing list, you’ll find references to several problems in POP3 servers. Let's start by thinking about the threats we'll face in designing our secure POP3 server. . . .