Subject: PC-Pine

From: Barry Cornelius <[email-masked]>
Date: Wed, 14 Jul 1993 13:22:11 +0100 (BST)

I tried PC-Pine Release 3.84 yesterday.  I used it as follows:

   (a) with LANWorkPlace for Dos (on a standalone PC rather than
       a Novell-networked PC),

   (b) with the existing IMAP daemon running on a Sun (i.e., the one
       that comes with Pine 3.07 rather than the new version of IMAP).

This experiment was successful: after asking for my username and password,
I was able to read my inbox from the Unix machine containing mailboxes.  It
was reasonably fast.

When PC-Pine started up the first time, it asked me for values for the 
user-id, personal-name and user-domain variables.   I supplied appropriate
values and these were stored in the \PINE\PINERC file.  These values are
used to generate the From line of a message.

Later, I changed the settings of these variables in the PINERC file.  I was then
able to send messages masquerading as someone else.  This is not desirable!
Have I got something wrong?  Is there anyway in which this can be avoided?

--
Barry Cornelius            Electronic mail: [email-masked]
Post:  Computing Service, University of Durham, Durham, DH1 3LE, England
Phone: Durham (091 or +44 91) 374 4717, Secretary:374 2892, Fax:374 3741

---

From: David L Miller <[email-masked]>
Date: Wed, 14 Jul 1993 08:20:05 -0700 (PDT)

Unfortunately, from a PC there is no way to enforce things like user-id,
etc.  No matter what we do (short of PEM or other secure mail system) we 
will always have authentication problems with PC-pine :(

--
|\ |  |\/|  David L. Miller    [email-masked]  (206) 685-6240
|/ |_ |  |  Software Engineer, Pine Development Team   (206) 685-4045 (FAX)
University of Washington, Networks & Distributed Computing
4545 15tn Ave NE, Seattle WA 98105, USA

---

From: "D.K.Brownlee" <[email-masked]>
Date: Wed, 14 Jul 1993 18:47:22 +0100 (BST)

Wouldn't it be possible to make PC-Pine ensure it had connected to the
	IMAP server & validated the user account & password that way before
	sending any mail - ie 1st time in a session the user goes to send
	a mail message, if they have not previously in that session read
	their inbox pcpine does some form of test-connect to the IMAP server
	to ensure their account details are valid?
		
		David

  |\/| [email-masked]. Network Analyst. Postmaster. Hostmaster.
  |  | Telephone: (+44) 71 477 8000 Ext:3757.
 Snailmail: E308, City University, Northampton Sq, Islington, London ECIV 0HB.

---

From: David L Miller <[email-masked]>
Date: Wed, 14 Jul 1993 13:46:47 -0700 (PDT)

That just makes them get a little more creative.  There are so many 
loopholes in current email *transport* mechanisms that anything you do 
on a user agent (like pine) is just window dressing.

---

From: Mark Crispin <[email-masked]>
Date: Wed, 14 Jul 1993 14:20:49 -0700 (PDT)

I need to step in on this discussion before it gets too far out of hand and
too many misunderstandings arise.

The issue of authentication of outgoing mail messages is an important one, and
we treat it as such.  We consider it to be of great importance that an
authentication mechanism be trustworthy.

[On a personal note: I was once ejected from a computer system and subjected
 to disciplinary action for an act I did not commit, on the basis of falsified
 authentication data.  Although I might wish that system administrators have
 become a bit more cognizant of reality in the intervening two decades, this
 has not happened.  If anything, they're even more clueless today.]

``Trustworthy'' means that authentication must give a reasonable assurance of
accuracy.  Most of the proposed mechanisms to accomplish authentication are
feel-good kludges that are easily circumvented and break another capability.

This does not mean that we have thrown up our hands and said ``it's impossible
so forget it.''  Rather, we *will* provide an outgoing message authentication
mechanism in future releases.  This will include mailer patches so it will be
possible to distinguish between messages which have been authenticated and
non-authenticated messages.

It is important to understand that PC Pine does *NOT* introduce any new
authentication problems.  These problems have always been there, since the
beginnings of ARPAnet e-mail over 20 years ago.  It is only recently that we
all have become sensitized to this problem and the urgency of its fix.

Please be assured that a fix *will* be forthcoming.  We have been dealing with
the problem, and its consequences, for some time now and it is reaching the
point of urgency.  It is just that the fix must be an infrastructure fix, not
a PC Pine fix.

Regards,

-- Mark --

---

From: "D.K.Brownlee" <[email-masked]>
Date: Thu, 15 Jul 1993 10:02:15 +0100 (BST)

You do what you can - nowthing short of dropping SMTP altogether
	is going to stop people telnetting to ol' port 25, but if you can
	simply go into a pinerc & change your ID it lowers the skill needed
	to fake messages.

	I don't know too much about IMAP - does it support mail sending as well
	as processing mailboxes?

	David

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 15 Jul 1993 11:24:06 +0200 (EET)

> used to generate the From line of a message.

I noticed this, too.  In a lab environment where a thousand students
use the PCs this is not viable.  It would be much better for PC-Pine
to ask the server about this info.  The server should know, and it
seems a natural extension to IMAP that the client can ask the server
what the headers should contain.  (Another possible extension is "what
other accounts should I check?" to cater for postmaster, support,
personal vs. business accounts and so on.)

--
Arnt Gulbrandsen
[email-masked]

---

From: Mark Crispin <[email-masked]>
Date: Thu, 15 Jul 1993 03:12:35 -0700 (PDT)

> 	simply go into a pinerc & change your ID it lowers the skill needed

It may be possible to ameliorate this somewhat, while keeping essential
functionality.  We'll discuss it within the Pine team a bit first.

> 	I don't know too much about IMAP - does it support mail sending as

No, and it won't.  There are excellent reasons why message posting should not
be in IMAP, which I will not go into here (being that this is the Pine-info
list, not the IMAP list).  The IMAP list archive on ftp.cac.washington.edu in
the file mail/imap_archive has some messages on this subject.

---

From: Terry Gray <[email-masked]>
Date: Thu, 15 Jul 1993 03:30:12 -0700 (PDT)

Arnt,
The reasons why it is not feasible or desirable to tie the config info 
(especially the username used to create From: lines) to the IMAP server 
providing the *inbox* have been mentioned in a previous message.

However, we completely agree that personal configuration info should be
obtained (or at least obtainable) from *some* server.  We just haven't gotten
to that yet, as our initial target for PC-Pine was the single-user PC case. 
Also, telling the MUA how to build outgoing messages is definitely outside
the intended scope of IMAP, but definitely within the intended scope of
IMSP... 

There are several issues that must be kept distinct:
  1. Making PC-Pine "multi-user"... that is making it aware of user 
     identity at start up so it can go find the appropriate personal 
     configuration info.  (Right now you must do this manually via the -p 
     flag, although a frontend menu or script could hide that).  
  2. Location of personal config files.  Clearly there needs to be a way
     for any Pine on any platform to get at a single instance of a user's
     config data.  (Right now you must rely on file access protocols, e.g 
     NFS for this.)
  3. Authentication of sent mail.  This is an MTA issue, but we will
     definitely be exploring ways to reduce the risks of abuse.  (Some 
     simple things might be helpful, but it is hard to justify anything
     elaborate with the "telnet xxx 25" option available.)

Regarding the "what other accounts should I check?" question:  That is 
exactly what the new "incoming-folders" variable in the PINERC is for, 
although it is general enough to use for multiple incoming folders on 
either a single host or multiple hosts.

-teg