Comment 1:

The argument from Maxim Khitrov on the mailing list was:
--------
RFC 4954 requires the client and server to only use PLAIN
authentication after establishing TLS. At the same time, it says
"Server sites SHOULD NOT use any configuration which permits a
plaintext password mechanism without such a protection mechanism
against password snooping."
I think the proper way to handle this in the client is to check
whether the PLAIN authentication mechanism was advertised. In other
words, replace the simple "!server.TLS" check at
src/pkg/net/smtp/auth.go:56 (go 1.0.3) with something that looks
through server.Auth entries. This way, the server decides what is
allowed. I do the same thing in my IMAP library, permitting the LOGIN
command only when LOGINDISABLED capability is not advertised.
-------

Comment 2:

It may be worth noting that the original CL for net/smtp allowed PlainAuth any time, but
rsc requested that it check for TLS.

Comment 3:

Also from golang-nuts:
"Indeed. I have some planned deployments based on Brad's go-smtpd that'll only listen on
the lo device. If those packets get snooped, I would have already had much bigger
problems than stolen passwords."

Status changed to Accepted.

Comment 4:

Mailed https://golang.org/cl/8279043

Comment 5:

This issue was closed by revision ca24f9e.

Status changed to Fixed.