Subject: Re: [EAI] I-D Action:draft-yee-eai-pop3-scenarios-00.txt

From: Shawn Steele <[email-masked]>
Date: Mon, 6 Jul 2009 19:28:54 +0000

> It has 3 characters, but takes 12 octets count
>   (3 octets/bytes each).  Message size is 12 + remaining size instead
>   of 3 + remaining size.

3*3 == 9?

I think that in addition to downgraded messages, there is also the potential for "downgraded authentication".  If I have a UTF-8 aware server, I may have a UTF-8 user name.  Assuming that the user name is the same as the mailbox name, with a downgraded ASCII address, then the server may desire to allow authentication with the ASCII mailbox name.  (Mostly I think this'd be interesting during migration as servers adopt EAI).

-Shawn

---

From: Joseph Yee <[email-masked]>
Date: Mon, 6 Jul 2009 17:11:52 -0400

>>  (3 octets/bytes each).  Message size is 12 + remaining size instead
Chinese characters have 4 octets each, likely a typo.  I will double  
check.  Thanks.

>
> I think that in addition to downgraded messages, there is also the  
> potential for "downgraded authentication".  If I have a UTF-8 aware  
> server, I may have a UTF-8 user name.  Assuming that the user name  
> is the same as the mailbox name, with a downgraded ASCII address,  
> then the server may desire to allow authentication with the ASCII  
> mailbox name.  (Mostly I think this'd be interesting during  
> migration as servers adopt EAI).
>

Even UTF8-mailbox without alternate address SHOULD allow  
authentication with plain ASCII.  It's up to design.  Although mostly  
the mailbox will be the login name, it doesn't have to be that way.

I think what's more important is to state allowing UTF8 encoded  
characters as part of login name & password.  Multiple different  
credential logins to same mailbox is allowed now, and I guess no one  
intended to restrict it because of EAI environment.

I will revise the doc to have pure ascii credential accessing the EAI  
mailbox.

thanks,
Joseph

> -Shawn
> _______________________________________________
> IMA mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ima

---

From: Randall Gellens <[email-masked]>
Date: Mon, 27 Jul 2009 01:36:40 -0700

At 5:11 PM -0400 7/6/09, Joseph Yee wrote:

> characters as part of login name & password.

The POP draft says the client knows when UTF8 is permitted in 
credentials because the server included the USER argument to the UTF8 
capability tag.  The client does not have to issue the UTF8 command 
before using UTF8 in authentication (the draft now implies that the 
client does need to.)

>  Multiple different credential logins to same mailbox is allowed 
> now, and I guess no one intended to restrict it because of EAI 
> environment.

Yes, exactly right.  This is a consideration for sites upgrading to 
support UTF8, but not specific to POP or IMAP.

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
I could never make out what those damned dots meant.
    --Lord Randolph Churchill, former Chancellor of the Exchequer,
      regarding decimal points

---

From: Joseph Yee <[email-masked]>
Date: Mon, 27 Jul 2009 09:37:40 -0400

On 27-Jul-09, at 4:36 AM, Randall Gellens wrote:

> credentials because the server included the USER argument to the  
> UTF8 capability tag.  The client does not have to issue the UTF8  
> command before using UTF8 in authentication (the draft now implies  
> that the client does need to.)

Yes, I misunderstand the pop3 draft before, I will change it in the  
next revision.

Joseph