Subject: Re: Is PINE Secure???

From: John Gardiner Myers <[email-masked]>
Date: Sat, 10 Dec 1994 22:57:52 -0500

Patches to add Kerberos V4 security to an older distribution of Pine
are available via anonymous FTP in ftp.andrew.cmu.edu:pub/cyrus-mail/
Some assembly may be required to fit this into 3.91, I haven't tried
it with that version yet.

---

From: [email-masked] (Pete Holsberg)
Date: Thu, 8 Dec 1994 03:07:03 GMT

Here is part of a note from the system administrator of a large nearby 
university, commenting on Pine.

Would a knowledgeable person please comment on his comments?

Thanks,
Pete
-------------

Over the last 6-9 months, we've been seeing more requests for the latest
in technology than for anything else.  In particular, while we see the
occasional request for pine and the like, we see 3-4 times as many
requests for network-based services such as SLIP/PPP, POP, NNTP and the
like.  We see these requests both from internal XXXXXX folk as well as
YYYYYY users. At the same time, due to security-related incidences there
has been a marked increase in concern on security-related matters. 
Because of user requests our direction has been set toward network-based
services.  Because of concern over security (and the recognition that many
network-based services require the use of the password which would pass
over the network in the clear), our efforts have been most recently based
in building a security service (library) which could be used by many if
not most of the network-based services.  To that end, we have
intentionally slowed the depolyment of any service which requires a
password since immediate deployment would add one more place where the
vulnurability of passwords passing over the network in the clear would
occur. 

For instance, to meet the goals above, we've decided to move to zmail, a
network-based GUI mail system based upon the POP protocols (but to move
toward IMAP soon).  Since POP requires the use of the password, it is
waiting upon the completion of the security library.  While in principle I
haven't any objection to pine in the short run, I wouldn't want to be put
in a position that if we bring pine up today, we're going to be willing to
support it in, say, 4 months.  Even though pine can be configured to use
POP, I know of no one willing to put in the work to make it IMAP
compliant.  

[I thought that pine *was* IMAP-compliant. --pjh]

Further, given that XXXXXX has chosen to move to zmail, I wouldn't want to
be responsible for adding the necessary security calls into pine which
would let it be compatible with our sense of security. This would mean
essentially that when we turn on the new zmail based system, pine would
break.  Is this acceptable? 

[Can anyone comment on pine's lack of security, vis-a-vis ZMAIL? --pjh]