(significantly reworded this question to fit better into crypto.se). I have static RSA keypairs for both sides and an encrypted transport that needs symmetric keys, and need to exchange session keys. ...
What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...