PLAIN authentication over SSL/TLS

Question

If I'm connecting to a mail server over SSL or TLS but using PLAIN authentication, is that secure?

Answer 1

Since the SSL/TLS connection is already encrypted, sending the password as PLAIN text doesn't hurt anything. You could encrypt the password as well, but then you're just double encrypting it. In most cases, I would consider that superfluous.

One case I can think of where you would use something other than PLAIN over SSL/TLS is if you choose to authenticate with certificates instead of passwords. Otherwise, I'd leave it at PLAIN.