Subject: Secure Pine IMAP Authentication?

From: Chance Reschke <[email-masked]>
Date: Sat, 31 Oct 1998 22:25:37 -0800 (PST)

Hi,

I've been trying to eliminate clear text passwords from our network and
had hoped IMAP mail readers could help in this effort.  Unfortunately, it
looks like Pine can only do IMAP "LOGIN" authentication, not the much more
secure "AUTHENTICATE" method. Is this true? (I know about using rsh -
That's not what I'm asking about). 

After looking at packet traces, it seems that the IMAP client in Netscape
Communicator uses "AUTHENTICATE LOGIN" when authenticating a user's IMAP
session with an IMAP4 server.  This appears to prevent the username and
password information from traversing the network in clear text.  More
packet traces reveal that Pine 3.96 appears to use "LOGIN" which passes
everything as clear text.  I had a quick look through the Pine sources,
and couldn't find any reference to the more secure authentication
mechanisms. 

Am I missing something?

Thanks,
	Chance

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------