Subject: Re: [EAI] POP/IMAP authentication?

From: Alexey Melnikov <[email-masked]>
Date: Sat, 04 Jul 2009 23:03:04 +0100

Hi Shawn,

Shawn Steele wrote:
>
> I’m leaving my comfort area J
>
>  
>
> Replying to Yao Jiankang’s draft, it occurred to me that the 
> alt-address probably needs to be allowed on authentication for email 
> accounts during the “transition period”.  So if I have a Unicode 
> address for my EAI mailbox, I may need to use the alt-address to logon 
> from my non-EAI-aware IMAP/POP client (might take a while to update my 
> phone).  I didn’t see that discussed in a quick peek at the IMAP/POP 
> drafts.
>
Authentication identities used by IMAP/POP servers don't have to look 
like email addresses at all (whether they are ASCII only or EAI email 
addresses).
In practice they frequently are, but this is an implementation detail. 
For example IMAP doesn't prevent use of LDAP DNs as authentication 
identities.

RFC 5255, section 5.1 talks a bit about UTF-8 authentication identities 
(userids). I suppose EAI IMAP document needs to say that it is updating 
RFC 5255.

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Sun, 12 Jul 2009 22:55:51 +0200

Alexey Melnikov skrev:
>> address for my EAI mailbox, I may need to use the alt-address to 
>> logon from my non-EAI-aware IMAP/POP client (might take a while to 
>> update my phone).  I didn’t see that discussed in a quick peek at the 
>> IMAP/POP drafts.
>>
On my home mailserver, where my mail address is "harald", my login 
identity is "hta".
On my Google mailserver, where my mail address is "[email-masked]", my 
login identity is "[email-masked]".

I don't think we need to say anything about the relationship between 
those entities in the EAI documents.
>
>
> RFC 5255, section 5.1 talks a bit about UTF-8 authentication 
> identities (userids). I suppose EAI IMAP document needs to say that it 
> is updating RFC 5255.
>
>
>
> _______________________________________________
> IMA mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ima

---

From: Shawn Steele <[email-masked]>
Date: Mon, 13 Jul 2009 17:59:09 +0000

> those entities in the EAI documents.

I realize that.  An end user using gmail or live mail or something is used to the email & logon being identical however.  Additionally they're needing EAI to solve an input-level problem.  So it doesn't do me much good to give me a Chinese alias and migrate my account, if I still have to use ASCII to log on.

So I think that the EAI documents should explicitly mention it as a possible paradigm, although as you point out there are many other ways of handling logon.  Certainly it isn't a MUST or SHOULD, but I think it could be informative.

-Shawn

---

From: Barry Leiba <[email-masked]>
Date: Tue, 14 Jul 2009 11:19:15 -0400

I think what Shawn's getting at, which Alexey and Harald haven't
addressed and which Shawn might not be making clear, isn't so much the
connection between the IMAP login and the email address as it is the
idea of limitations on, say, the user's device.

If I'm migrated to a new email address and if, in the process, I also
get a nifty new non-ASCII login (whether or not it's the same as the
email address... surely we can see that migrating both at the same
time might be a common thing), that may be OK when I'm using my
laptop, where I can enter, say, "лзыба" just fine.  But I might not
have a mobile phone yet that can enter Cyrillic letters (or Thai
characters, or whatever), and then I'd have a hard time logging in
from my mobile.

And I think Shawn's point, which I agree with if I'm getting that
right, is that it wouldn't be a bad thing to point that out and to
suggest that an ASCII version of the login be available for a
transition.  Perhaps some text vaguely like this:

---
When a user's email address is changed, it may be common -- perhaps
desirable -- to change the user's login identification as well.  It's
possible, however, that a user who gets a non-ASCII email address
might still have devices that are unable to enter a non-ASCII login
ID.  It is probably wise, therefore, to continue to accept an ASCII
version of the user's login ID -- perhaps the old one, or perhaps an
alternate ASCII version of the new one -- until the user confirms that
it is no longer necessary.
---

Barry

---

From: "Daniel Taharlev" <[email-masked]>
Date: Tue, 14 Jul 2009 15:22:03 +0000

Many of my users also have different machines with different keyboard layouts, and accounts set on several machines, it's not just a mobile phone issue imho... Be gentle it's my first post

[email-masked]

-----Original Message-----
From: Barry Leiba <[email-masked]>

Date: Tue, 14 Jul 2009 11:19:15 
To: Shawn Steele<[email-masked]>
Cc: [email-masked]<[email-masked]>
Subject: Re: [EAI] POP/IMAP authentication?

---

Barry

---

From: Shawn Steele <[email-masked]>
Date: Tue, 14 Jul 2009 20:32:12 +0000

Yes Barry, you said it better than I did.

I believe that some (not all) systems may want to permit ASCII-only AND Unicode authentication because a) Presumably Unicode is "easier" for the user (why we're doing this work), but b) Their mail client or phone or whatever may be restricted to ASCII for now.

Your text conveys the idea, it's not just migration though, it could be new accounts.  Also I only think it's informational, some apps may not need the handle this scenario.  Maybe ?

------
When a user creates a new Unicode account, or migrates an existing ASCII account to Unicode, applications need to consider the appropriate authentication needs for those users.  Some users may desire Unicode login information, yet be restricted to ASCII devices or clients.  In those cases, systems may choose to provide both a Unicode and an ASCII authentication mechanism.  This is not required, and systems may assign logon credentials as they see fit, however it is recommended that application developers carefully consider the use cases and needs of the end users to determine if ASCII and/or Unicode credentials are required.

Certain limitations may impact decisions about logon credentials:  Keyboards available to the user, anticipated public terminal use like kiosks or internet cafes, software limitations such as legacy mail clients, and hardware limitations such as cellular or satellite phones.

-Shawn

-----Original Message-----
From: Daniel Taharlev [mailto:[email-masked]]
Sent: Tuesday, July 14,  2009 8:22
To: [email-masked]; Shawn Steele
Cc: [email-masked]
Subject: Re: [EAI] POP/IMAP authentication?

[email-masked]

-----Original Message-----

---

Barry

---

From: Randall Gellens <[email-masked]>
Date: Mon, 27 Jul 2009 01:31:52 -0700

At 8:32 PM +0000 7/14/09, Shawn Steele wrote:

>  When a user creates a new Unicode account, or migrates an existing 
> ASCII account to Unicode, applications need to consider the 
> appropriate authentication needs for those users.  Some users may 
> desire Unicode login information, yet be restricted to ASCII 
> devices or clients.  In those cases, systems may choose to provide 
> both a Unicode and an ASCII authentication mechanism.  This is not 
> required, and systems may assign logon credentials as they see fit, 
> however it is recommended that application developers carefully 
> consider the use cases and needs of the end users to determine if 
> ASCII and/or Unicode credentials are required.
>
>  Certain limitations may impact decisions about logon credentials: 
> Keyboards available to the user, anticipated public terminal use 
> like kiosks or internet cafes, software limitations such as legacy 
> mail clients, and hardware limitations such as cellular or 
> satellite phones.

I'm not sure that text such as this belongs in the POP and IMAP 
documents, as opposed to the framework document.  Maybe it belongs in 
the POP and IMAP, but I'm not convinced yet.  The idea seems to be to 
convey some basic information regarding how accounts should be set 
up, which can be helpful, but doesn't really have anything to do with 
POP/IMAP, aside from the account data being used there (as well as 
elsewhere).

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
The whole dream of democracy is to raise the proletarian to the level
of stupidity attained by the bourgeois.            --Gustave Flaubert

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 27 Jul 2009 13:02:49 +0200

Randall Gellens wrote:

>> desire Unicode login information, yet be restricted to ASCII devices 
>> or clients.  In those cases, systems may choose to provide both a 
>> Unicode and an ASCII authentication mechanism.  This is not required, 
>> and systems may assign logon credentials as they see fit, however it 
>> is recommended that application developers carefully consider the use 
>> cases and needs of the end users to determine if ASCII and/or Unicode 
>> credentials are required.
>>
>> Keyboards available to the user, anticipated public terminal use like 
>> kiosks or internet cafes, software limitations such as legacy mail 
>> clients, and hardware limitations such as cellular or satellite phones.
>
> convey some basic information regarding how accounts should be set up, 
> which can be helpful, but doesn't really have anything to do with 

I agree, this text would be better in the framework document. We should 
revise the framework document anyway.

---

From: Harald Alvestrand <[email-masked]>
Date: Mon, 27 Jul 2009 13:18:59 +0200

Alexey Melnikov wrote:
> I agree, this text would be better in the framework document. We 
> should revise the framework document anyway. 
It may be even better in one of the "implementation advice" documents 
(which we'll have to sort out today).

               Harald

---

From: Xiaodong Lee <[email-masked]>
Date: Mon, 27 Jul 2009 14:05:09 +0200

agree with harald, we should give some implementation suggestion for 
software vendors or services providers.
Another thing is about the variant of username,  we may give suggestion 
on to-do, instead of how-to-do.

Harald Alvestrand wrote:
>>> documents, as opposed to the framework document.  Maybe it belongs 
>>> in the POP and IMAP, but I'm not convinced yet.  The idea seems to 
>>> be to convey some basic information regarding how accounts should be 
>>> set up, which can be helpful, but doesn't really have anything to do 
>>> with POP/IMAP, aside from the account data being used there (as well 
>>> as elsewhere).
>>

---

From: Barry Leiba <[email-masked]>
Date: Mon, 27 Jul 2009 06:52:46 -0400

> I'm not sure that text such as this belongs in the POP and IMAP documents,
> as opposed to the framework document.  Maybe it belongs in the POP and IMAP,
> but I'm not convinced yet.  The idea seems to be to convey some basic
> information regarding how accounts should be set up, which can be helpful,
> but doesn't really have anything to do with POP/IMAP, aside from the account
> data being used there (as well as elsewhere).

I'd be happy to have in the framework doc.

Barry