Subject: Re: Secure Pine IMAP Authentication?

From: Jauder Ho <[email-masked]>
Date: Sun, 1 Nov 1998 03:19:14 -0800 (PST)

I think Netscape does base64 encoding which means that it still sends it
as cleartext across the network.

--Jauder

On Sat, 31 Oct 1998, Chance Reschke wrote:

> Hi,
> 
> I've been trying to eliminate clear text passwords from our network and
> had hoped IMAP mail readers could help in this effort.  Unfortunately, it
> looks like Pine can only do IMAP "LOGIN" authentication, not the much more
> secure "AUTHENTICATE" method. Is this true? (I know about using rsh -
> That's not what I'm asking about). 
> 
> After looking at packet traces, it seems that the IMAP client in Netscape
> Communicator uses "AUTHENTICATE LOGIN" when authenticating a user's IMAP
> session with an IMAP4 server.  This appears to prevent the username and
> password information from traversing the network in clear text.  More
> packet traces reveal that Pine 3.96 appears to use "LOGIN" which passes
> everything as clear text.  I had a quick look through the Pine sources,
> and couldn't find any reference to the more secure authentication
> mechanisms. 
> 
> Am I missing something?
> 
> Thanks,
> 	Chance
> 
> 
> 
> 
> -----------------------------------------------------------------
>  For information about this mailing list, and its archives, see: 
>  http://www.washington.edu/pine/pine-info/
> -----------------------------------------------------------------
> 
>