I recently discovered that Outlook for Android uses an intermediate server for IMAP connections, meaning that:
- mail is accessed in plain-text by a third-party
- credentials are known in plain-text by a third party
This defeats much of the purpose of encrypting IMAP connections in the first place, since the information is no longer private between the host server and the client.
As I was unhappy with this, I switched to Bluemail since I saw that they have an option to configure either push or fetch. However, I have now found that, regardless of how this option is configured, the account credentials are still held by the Bluemail server.
How can I connect to an IMAP server over TLS from Android without mail and credentials being shared with third party servers and providers?
Also, why has this become the norm, considering that the security implications are woeful.