I doubt that the above post is going to suddenly cause a mass migration to IncrediMail. In fact, my exposure of how simple it is to convert IncrediMail to use a common path for the message store for all implementations will probably be seen as further evidence that it is unsuited to a business or secure environment.
But maybe that is all relative. Here's the thing: As I showed with my VM example, IncrediMail can be made to share a networked drive or folder for its message store. This means you could set up an email store server for all accounts, and that would be a common storage point for all originating and received emails. Now since IncrediMail treats all accounts in common, all employees directed to the same folder would show up together. So if you set up a folder for Group A, and put all the employees in Group A there, then any PC in group A would have access to that group's emails, but each employee would presumably have direct access to only their account. That makes for some interesting possibilities, such as simultaneously backing up or duplicating an entire organizations message store in one operation.
But here is where it could get unpleasant. The account password is stored in the Registry as well, along with the password for accessing the account via the email service. You could replace the stored account access password with your own, and then have access to the contents of that user's emails. Now in the case of a disgrunted employee, this could be a good thing, because employees have no right to privacy when it comes to using compnay equipment and services, so you could dig through and find out exactly what that employee has been up to. But on the other hand, someone could sneakily get into the boss's email and find out about things that they are not permitted to know.
And you do not actually need to get on a Group A machine to do it. All you need is a PC with IncrediMail installed, access to the email store server, and you could modify the AppplicationPath to point to Group A's folder, then set the GUID to the same value as the Boss's account, store your own access password, and you are in. Just like any other tool, there is good and bad applications when you have a bit of knowledge to work from.
Of course the stored passwords are encoded so that you cannot easily determine what they are, but if you have access to your own account, you can merely set the encoded password for a different account to the same code, then use your own password at the user level to get in. Or you can reflag the account so that no password is required to get into it.
At the same time, suppose you had that disgrunted employee, and you want to immediately curtail their access to the accounts. You can remove the account from IncrediMail, but that is just a Registry flag. You are already aware that the actual account still remains. But now you know how to eliminate it completely.
Do other email clients tend to keep the same accounts lying around, or does the act of removing them mean that they are erased? It's not a question that you can take for granted.
So there are issues to consider when deciding whether to employ IncrediMail or not, and personally, for a personal PC, it is a very attractive choice. But I would be seriously troubled were I to find it used in a business environment, where security becomes a real concern.
I'm not knocking IncrediMail's design objectives in the use of the Registry. It's approach allows for the easy removal, reinstall, repair, and upgrade of the IncrediMail program, without sacrificing existing email accounts or contents. And we are able to use it here to extend that concept even further, so that you can do many things, like have a common email store, even keep that store on a centralized PC or networked drive. And let's face it, Registry tweaks are not something everybody is prepared to do, so it takes a fair amount of daring to make the attempt, or to figure out what to do. But nothing is beyond the capabilities of the people who frequent these forums.
