To be clear, the issue in "Test A" is the lack of certificate validation. It wasn't immediately clear (poorly worded, IMO) but that's the (only) issue I see in that scenario and that is, indeed, a security issue (allows a MITM attack).<p>"Test B", however, is not a security issue at all, IMO; instead, it is "working exactly as intended".<p>> <i>The Apache logs are not even needed without SSL enabled because the first request to the web server includes the username and password in clear text.</i><p>If SSL isn't enabled then, yes, of course it does. This may come as a shock to the author but standard IMAP4/POP3 without SSL <i>also</i> sends credentials in the clear (as does -- <i>gasp!</i> -- every other plain-text protocol!)<p>> <i>Even when SSL is not enabled the client should not be sending the credentials without first verifying that it is a real exchange server.</i><p>And just how would the client do that? Using an (easily spoofable) "Server:" header in the HTTP response?<p>> <i>Realistically the client should not even send the password before verifying the user exists.</i><p>That, however, would be an information disclosure vulnerability (identifying valid usernames on the server). That's why no other mail server in use on the Internet does that either. Not to mention that it's real easy for a malicious attacker (in control of the server) to lie about that too.<p>Aside: if you're running an Exchange server, set up Autodiscover [0] and all your users need to set up their mail account is their username and password (no server details are needed!). For other (i.e. non-Exchange) mail servers, there's a similar "Autoconfiguration" method that is supported by various mail clients, such as Thunderbird [1].<p>[0]: <a href="https://msdn.microsoft.com/en-us/library/office/jj900169(v=exchg.150).aspx" rel="nofollow">https://msdn.microsoft.com/en-us/library/office/jj900169(v=e...</a><p>[1]: <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration" rel="nofollow">https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird...</a>