On 06/01/18, Richard Menedetter said the following...
 
 RM> That is a very questionable default of Mystic.
 RM> I think it is called secure something, and is by default enabled.

It's the Allow Unsecure option in the Binkp configuration. It was changed to
allow unsecure connections by default a while ago after this issue was pointed
out to the author, but anyone who set up their BBS before late last year will
probably still be operating under the old default.

--- Mystic BBS v1.12 A39 2018/04/21 (Linux/64)