Subject: Re: Make imap work without "rsh"

From: Bill Yeager <[email-masked]>
Date: Fri, 28 Jul 1995 16:25:52 -0800 (PDT)

>  If you failed to take the measures noted above, then you are deluding
>  yourself
>  in thinking that you accomplished anything.  Actually, if your policy
>  really
>  is "always require a password", then nothing short of doing ALL of 1-5
>  above
>  will satisfy that policy.

Calm down Mark (:

---

From: Robert Moskowitz <[email-masked]>
Date: Tue, 01 Aug 1995 06:58:31 -0400

At 10:24 AM 7/31/95 -0700, Mark Crispin wrote:
>On Mon, 31 Jul 1995 06:49:05 -0400, Robert Moskowitz wrote:
>> >> 	I won't presume that. It affects everybody.
>> >It affects everybody who uses c-client.
>> Gee am I that much of a newbie or am I missing something here...
>
>Yes, you are.  ;-)

Double induendo time, huh :)

>Of course, Kerberos, S/Key, etc. cure these and many other ills.  But as you
>have noticed, Kerberos is not plug'n'play.  Worse, Kerberos is a moving
>target.  For better or worse, passwords in the clear and rsh are going to be
>with us for some time to come, and I do not feel that it is appropriate to
>bash software for using what are often the only mechanisms available.

Granted.  But take a look at S-HTTP.  One of its security mechinisms is for
the server to send the client a nonce that the client can use to encrypt all
further traffic.  This is an elegant way to add security to an unknown
client, allowing for encryption of even simple userID/password data streams.

BTW, IMAP is 'less' secure than, say FTP.  In FTP you have to capture two
packets, in IMAP both userID and Password are in the same.  At least with
Simeon...

Robert Moskowitz
Chrysler Corporation
(810) 758-8212