Subject: SMTP Authentication

From: Kassim Kasmani <[email-masked]>
Date: Fri, 11 Jun 2004 22:42:05 -0400 (EDT)

My ISP requires SMTP authentication.  In Pine setup, in the SMTP field, I
put in the server address.  Where do I put in the username/password?

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Gopi Sundaram <[email-masked]>
Date: Fri, 11 Jun 2004 23:30:23 -0500 (CDT)

On Fri, 11 Jun 2004, Kassim Kasmani wrote:

> My ISP requires SMTP authentication.  In Pine setup, in the SMTP
> field, I put in the server address.  Where do I put in the
> username/password?

FAQ.

http://www.zrox.net/Mail/Pine/write.html#smtpauth

-- 
Gopi Sundaram
http://www.zrox.net/Mail/Pine/

---

From: "Arthur H. Johnson II" <[email-masked]>
Date: Sat, 12 Jun 2004 00:40:57 -0400 (EDT)

This has to be the most asked question on this list.

-- 
Arthur H. Johnson II
[email-masked]
-- 
ICQ:  31770438     AIM:  bytor4232
MSN:  bytor4232    YIM:  arthurjohnson
IRC:  [email-masked]

---

From: Matt Ackeret <[email-masked]>
Date: Mon, 14 Jun 2004 11:15:23 -0700 (PDT)

On Fri, 11 Jun 2004, Gopi Sundaram wrote:

>Date: Fri, 11 Jun 2004 23:30:23 -0500 (CDT)
>From: Gopi Sundaram <[email-masked]>
>To: Pine Discussion Forum <[email-masked]>
>Subject: Re: SMTP Authentication
>

If this is a FAQ, shouldn't it be covered in *pine's* documentation?

---

From: Ryan Barrett <[email-masked]>
Date: Mon, 14 Jun 2004 12:17:42 -0700 (PDT)

>>> My ISP requires SMTP authentication.  In Pine setup, in the SMTP
...
> If this is a FAQ, shouldn't it be covered in *pine's* documentation?

for standard SMTP auth, it is. it's in the help text for the smtp-server 
value on the config page.

as for the other auth style, i'd never even heard of it before i read that 
faq page. :P it probably wouldn't hurt to have a line or two about it, but 
i won't fault them for leaving it out.

-Ryan

---

From: Alexander V Alekseev <[email-masked]>
Date: Tue, 15 Jun 2004 11:31:10 +0400 (MSD)

Hello!

> http://www.zrox.net/Mail/Pine/write.html#smtpauth
	BTW: Why there is no switch like /password= ?

		Bye. Alex.

--

---

From: "Arthur H. Johnson II" <[email-masked]>
Date: Tue, 15 Jun 2004 09:12:55 -0400 (EDT)

> 	BTW: Why there is no switch like /password= ?

I'm not sure about the other os'es, but for Linux you have to enable the
password file option at compile time.  Once you edit/patch pine and
compile and install it, touch ~/.pine.pwd and when you enter a password,
it will ask if you want to preserve it on disk.  After that, it won't ask
you for a password.

Here is the patch I usually use, its quite simple however and you can
probably edit the os-lnx.h file directly.

-- BEGIN PATCH --
diff -ruN pine4.53.orig/pine/osdep/os-lnx.h pine4.53/pine/osdep/os-lnx.h
--- pine4.53.orig/pine/osdep/os-lnx.h	2001-02-06 20:05:06.000000000 -0500
+++ pine4.53/pine/osdep/os-lnx.h	2003-02-22 08:53:57.000000000 -0500
@@ -89,6 +89,7 @@
  ----*/
 #define BACKGROUND_POST

+#define	PASSFILE ".pine.pwd"

 /*----------------------------------------------------------------------
-- END PATCH --

---

From: Alexander V Alekseev <[email-masked]>
Date: Tue, 15 Jun 2004 17:31:23 +0400 (MSD)

Hello!

> it will ask if you want to preserve it on disk.  After that, it won't ask
	Thanks! As documentation says, it's enabled by default for
PC-PINE. So I'll use it under Windows.
	For Linux I use fetchmail.

	Bye. Alex.

--

---

From: Gopi Sundaram <[email-masked]>
Date: Tue, 15 Jun 2004 14:00:25 -0500 (CDT)

> 	BTW: Why there is no switch like /password= ?

Because it will be stored in your .pinerc file, and you shouldn't store
plaintext passwords in a file. Heck, the encryption on the pine password
file is weak enough, which is probably why it isn't enabled by default.

---

From: Alexander V Alekseev <[email-masked]>
Date: Wed, 16 Jun 2004 10:51:53 +0400 (MSD)

Hello!

> Because it will be stored in your .pinerc file, and you shouldn't store
	"shouldn't" is not "must not". It should be up to user.

> file is weak enough, which is probably why it isn't enabled by default.
	That password is in my fetchmailrc. So, having it
in pinerc won't break security. ;-))

	BTW: I found that PASSFILE is only valid for IMAP, isn't it?
What should I do for smtp? Having passwords in some file is usefull
for roles with different smtp servers.

		Bye. Alex.

--

---

From: Ryan Barrett <[email-masked]>
Date: Wed, 16 Jun 2004 00:39:38 -0700 (PDT)

> 	"shouldn't" is not "must not". It should be up to user.

when storing passwords on disk, the obfuscated vs. plaintext debate is as 
old as time. i'll be the Bad Guy and say, please, let's not have that 
debate again. :P

true, there's also the distinct UI question of how to specify the 
password - stored separately on disk, command-line arg, or option in the 
folder name. however, since the pine developers have decided to obfuscate 
it, it has to be stored on disk, which makes the UI question moot.

-Ryan

p.s. if you really want to explore the obfuscated vs. plaintext debate, 
there's a decent analysis here:

http://gaim.sourceforge.net/plaintextpasswords.txt

and an even longer analysis on the gaim mailing list, here:

http://sourceforge.net/mailarchive/forum.php?thread_id=4588877&forum_id=9587

--
"Woooo!"  -Twinsen

---

From: Alexander V Alekseev <[email-masked]>
Date: Wed, 16 Jun 2004 11:48:51 +0400 (MSD)

Hello!

> there's a decent analysis here:
	Really, I want to have roles with different authentication to
different servers! And not to remember paswords in mind.

		Bye. Alex.

--

---

From: Matt Ackeret <[email-masked]>
Date: Wed, 16 Jun 2004 11:00:29 -0700 (PDT)

On Wed, 16 Jun 2004, Ryan Barrett wrote:
> true, there's also the distinct UI question of how to specify the password -
> stored separately on disk, command-line arg, or option in the folder name.
> however, since the pine developers have decided to obfuscate it, it has to be
> stored on disk, which makes the UI question moot.

That doesn't mean it must be stored on disk (I presume you mean as a separate
file) at all.

Let the user type it in, and transmogrify it after they hit return.
Don't let them ever edit the field with the munged password in there, and
explain why it looks like "garbage" to them.  (or just show it as ****
always)

---

From: "Arthur H. Johnson II" <[email-masked]>
Date: Wed, 16 Jun 2004 14:35:09 -0400 (EDT)

> for roles with different smtp servers.

I do alot of SMTP auth, and the passwords get stored in my .pine.pwd after
I enter them once and pine asks if to store them.