How secure is CRAMMD5?

First off, the plaintext bit is bullshit - most POP/SMTP *nix solutions can be retrofitted to not need this. With this out of the way... ...CRAM-MD5 has shocking vulnerabilities - coming from its MD5 tie. However, it's still better than plaintext. In order of appearance and "OMGWTFBBQ-ness": A server using CRAM-MD5 can be spoofed/MitM-ed as the client never checks for the server's authenticity Passwords are crackable offline (which should be obvious)

All the MD5 vulnerabilities apply CRAMMD5 is effectively MD5( (key XOR padding) concat MD5(key XOR morepadding) concat value) coupled with challenge-responses. The key is the user's password - the value is the challenge. So, if the challenge is unknown, it'd be perfect. Sadly, it isn't, as it is transmitted in plain text. Basically, avoid it if you can. GPUs can compute a frightening number of MD5 hashes these days. However, a simple solution is just to SSL the lot. A certificate is worth peanuts these days.