Subject: Possible bug with pine - imap allows login w/o passwd

From: Ralph Sims <[email-masked]>
Date: Mon, 1 Nov 1993 21:08:54 +0000

I have been using pine (albeit 3.85, as that's the last linux port that I 
have--awaiting 3.88) via imap.  It appears that if I close the remote 
mailbox and exit the host and rather invoke the remote host again via 
imap, that I am not prompted for a userid or password.

Is there some type of 'hidden authentication' still in effect that would 
not allow someone 'posing' as me to log in via imap and access my mailbox 
during this brief period.  It seems that if I exit the host and look at 
[INBOX] as a new folder and then go back to the remote host, all's well.

Possibly, I'm seeing that pine is still connected via imap and doesn't 
actually close the connection until a new folder is opened.

Ideas?

---

From: David L Miller <[email-masked]>
Date: Mon, 1 Nov 1993 15:50:13 -0800 (PST)

A folder remains open until you exit pine or open another folder, the 
exception being the INBOX which remains open until you exit Pine.  Is 
this what you are seeing?

|\ |  |\/|  David L. Miller    [email-masked]  (206) 685-6240
|/ |_ |  |  Software Engineer, Pine Development Team   (206) 685-4045 (FAX)
University of Washington, Networks & Distributed Computing
4545 15th Ave NE, Seattle WA 98105, USA

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Nov 1993 11:09:20 -0800 (PST)

On Mon, 1 Nov 1993, Ralph Sims wrote:
> during this brief period.

The only ``hidden authentication'' in Pine/imapd is that if you can rsh 
to the remote host for free, you can imap to it for free.  In other 
words, the answer is NO.

> actually close the connection until a new folder is opened.

This can happen.  The primary INBOX is always kept open, and secondary 
streams can be recycled to open new folders.

---

From: Ralph Sims <[email-masked]>
Date: Tue, 2 Nov 1993 19:58:12 +0000

I've just compiled 3.87 for linux.  We're up to speed now.  All that 
remains is to work on the the .pinerc file (beginning to resemble a 
sendmail.cf file to some degree with all the options available).

Thanks to you and David Miller.  The pieces to the puzzle are now easier to 
put together.