This is a follow-up question to Does TLS use RC4-drop[n]?.
As mentioned in section 6 of RFC4345, there are weak distinguishers for RC4 keystreams available that even work for keystreams that originate from different keys, and regardless of the distance from the start of the keystream. Doesn't that make an attack on schemes that send user passwords in RC4 protected connections?
I'm thinking about protocols that always send the password at a well known offset, e.g. TLS protected IMAP and SMTP.
Theoretically, it should even be possible with an HTML authentication form, but the position of the password in the response might not be as obvious in that case.
Has anybody ever tried to recover a password from a number of RC4 protected IMAP or (authenticated) SMTP connections? Because of the BEAST attack, many mail services now default to RC4 for encrypting user connections (which always include the credentials at a fixed offset), and depending on the mail client used, authentication might happen frequently (especially IMAP clients often keep a number of IMAP connections open, which might be forced to reconnect even more frequently by an active attacker).