Subject: Re: SMTP AUTH design-team meeting addendum

From: Dave Crocker <[email-masked]>
Date: Wed, 07 Oct 1998 10:28:39 +0800

Small suggested change to put make the language state the positive:

At 12:35 PM 9/8/98 -0700, Randall Gellens wrote:
>If an existing SMTP server is reconfigured or upgraded to advertise
>authentication mechanisms, this is likely to cause local upgraded SMTP
>clients to prompt users for their passwords when sending mail.  This
>behavior change may be undesirable at some sites, while other sites may
>desire it.  Therefore, servers SHOULD be configurable to not advertise
>authentication mechanisms which do not authenticate the server to the
>client or include a privacy layer, such as CRAM-MD5, unless the client
>is granted additional delivery rights or services by such
>authentication.

...desire it.  Therefore servers SHOULD be configurable to advertise
authentication mechanisms only to clients which must use those
authentication mechanisms to obtain additional delivery rights or services.

d/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Dave Crocker                                         Tel: +1(408)246 8253
<mailto:[email-masked]>                        675 Spruce Drive
                                                  Sunnyvale, CA 94086 USA
Brandenburg Consulting
<http://www.brandenburg.com>                         Tel: +60(19)3299 445
                                              Post Office Box 296, U.P.M.
Fax: +1(408)246 8253                     Serdang, Selangor 43400 MALAYSIA

---

From: Randall Gellens <[email-masked]>
Date: Thu, 8 Oct 1998 15:16:38 -0700

I agree this change makes the text easier to read.

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 10 Oct 1998 01:04:32 +0400

Chris Newman wrote:

> On Fri, 4 Sep 1998, John Gardiner Myers wrote:
> > The SMTP AUTH spec should mention the principle that servers SHOULD NOT
> > advertise the existence of mechanisms whose use provide no benefit to
> > either client or server.  For example, consider a server which
> > implements CRAM-MD5 authentication, and has the policy that clients
> > connecting from certain networks have authorization which is not
> > affected by authentication.  Since CRAM-MD5 does not implement a
> > security layer, it does not itself provide a benefit to the client.  If
> > the policy for a given client is such that CRAM-MD5 authentication does
> > not affect the client's authorization, then the server should not
> > advertise the CRAM-MD5 mechanism to that particular client.
>
> I agree.  But this wording is a bit subtle.  Here's another try:
>
> authentication mechanisms, this is likely to cause new SMTP client UIs to
> begin prompting users for their passwords.  As such a behavior change may
> be undesirable at some sites, servers SHOULD NOT advertise client-only
> authentication mechanisms, such as CRAM-MD5, unless they grant the client
> additional delivery rights or services.

>From other side, IMHO, new clients MAY (or even SHOULD) remember passwords.
However clients SHOULD be configured not to do this.

Cheers,
Alexey Melnikov
------------------------------------------
SMTP/POP3/IMAP4/ACAP servers creation team
"ACAP Explorer" client

Epsylon Technologies, Russia
 http://www.demo.ru

Imap Development Kit (my own product)
http://www.demo.ru/homerus/mail/idk/index.htm
------------------------------------------

---

From: Dave Crocker <[email-masked]>
Date: Wed, 07 Oct 1998 10:28:39 +0800

d/

---

From: Randall Gellens <[email-masked]>
Date: Thu, 8 Oct 1998 15:16:38 -0700

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 10 Oct 1998 01:04:32 +0400

Cheers,
Alexey Melnikov