POP3
Post Office Protocol, version 3POP3 is the simplest possible way to collect mail. A client connects, lists what is waiting, downloads it, and classically deletes it from the server — the mailbox is a doormat, and once collected the mail lives on one machine only.
POP3 downloads mail and hands ownership to the device — simple, offline-friendly, and hopeless once you have more than one device.
How it works
There are no folders, no flags and no server-side search: POP3 knows only a numbered list of messages waiting. Clients that keep mail on the server use a “leave a copy” option the protocol was never really designed around.
What POP3 does, step by step
The client connects over TLS and logs in; the server locks the mailbox for the duration.
STAT gives a count and total size; LIST numbers each message and its length.
RETR downloads a message in full — there is no fetching just the headers — and DELE marks it for removal.
QUIT applies the deletions and unlocks the mailbox; the mail now exists only on that device.
In cybersecurity
POP3 is old enough that its default was a plaintext password — and its download-and-delete habit means the only copy of your mail may be on a laptop with no backup.
Implicit TLS from the first byte; plain 110 without STARTTLS exposes the password and the mail.
Like IMAP, basic POP3 login sidesteps modern MFA — disable it where you can.
Deleting from the server moves the risk to the endpoint, which is rarely backed up as well.
Mail collected and removed leaves little server-side evidence for an investigation.
The exclusive lock means a stuck session can deny the real user access to their mail.
Central storage is easier to secure, back up and monitor than a fleet of laptops.