Subject: Authentication of sender's identity

From: Adam Treister <[email-masked]>
Date: Wed, 31 May 95 10:44:38 -0700

Does the c-client have mechanisms for "weakly" authenticating a sender's
identity?  Or have other remote clients come with a simple method to do this?

The current version of Mailstrom makes sure that the user has logged onto the
IMAP server and that the account name on that server is somewhere in the FROM
field of the outgoing message.  This is running into pbs as more and more sites
use email addresses that are closer to the person's real name than to their unix
account name.

I realize that SMTP and sendmail are inherently insecure, and don't want to
require PGP or some "real" authentication at this point, but I do want to mildly
guard against the naive user accidentally putting something stupid as the return
address in their prefs, or a user sending a message from someone else's
workstation accidentally representing the message as being from that person, and
to force the prankster to use sendmail or Netscape to forge their flames. 

Is there a simple way to do this without causing headaches for the admin who is
implemention a modern mail router?

Adam

---

From: Mike Macgirvin <[email-masked]>
Date: Wed, 31 May 1995 11:39:17 -0700 (PDT)

>  identity?  Or have other remote clients come with a simple method to do 

	I think the currently accepted practice (somebody please correct me if
I'm wrong), is to place the local credentials in the "Sender:" field; (not the
"From:" field), and most MUA's also place this into the Message-ID somewhere.
	You want somebody to be able to tweak the "Reply-To:" field, since you
need to allow somebody to specify a system with SMTP as a reply-to, which not
all workstations have; especially in an IMAP environ. 
	I just copy this value to the "From:" envelope. No harm done, since the
real credentials already show up in two places in the header (at least). More
paranoid mailers set the "From:" line based on the GECOS field from the Unix
passwd file, which is usually the human name; along with the login credentials.
(But be careful not to include office locations and phone numbers (hint:
commas) unless you quote the whole thing.)
	How can you protect against an invalid reply-to? Can't answer that one.
They'll find out soon enough... Unless you want to go out and probe the mailer
yourself (and not all mailers allow probes).  You might have to just let them
shoot themselves in the foot.
	The more recent c-clients have a function "myusername()" to obtain the
local credentials, but I haven't got any idea how this translates to a Mac or
other insecure OS.

mike

---

From: Mark Crispin <[email-masked]>
Date: Wed, 31 May 1995 12:11:23 -0700 (PDT)

IMHO, Mike Macgivin's solution is the correct one; put what you allege to be
authenticated credentials in the Sender field, and let the user say what goes
in the From.  Copy Sender -> From if the user doesn't specify it (and possibly
suppress generating the Sender if the From is identical).  Hope for the best.

With varying degrees of increasingly annoying behavior, you may decide various
additional measures.  Note the use of the word "annoying" here -- even well
intentioned features to prevent user blunders can be extremely annoying to
experts.  You have to balance the annoyance factor with your business needs
though.  Not an easy choice.

There is no myusername() call in DOS or Mac c-client; it only exists on
systems such as Unix, VMS, and TOPS-20 where that's a reasonable concept.

---

From: Chris Newman <[email-masked]>
Date: Thu, 1 Jun 1995 11:00:51 -0400 (EDT)

Another simple authentication technique (beyond the Unix getusername()
function) that you can use is to get the "common.from" option from the
IMSP server.  This is set up in such a way that the site administrator
can decide whether or not to allow the user to modify their from
address from a site-configured canonical form.

-----
Chris Newman <[email-masked]>, http://www.contrib.andrew.cmu.edu/~cn0h/