Re: Any drafts for IMAP4/TLS and/or POP3/TLS

> This paragraph is likewise troubling. Obviously, we'd like to market our
> products as offering _some_ level of security, and 40 bit encrypted streams
> are significantly harder for an intruder to browse than a plaintext stream,
> so it *is* secure from "casual" eavesdropping. It's all a matter of degree.

Indeed.  But I'd have a hard time supporting the claim that 40 bit
crypto is secure from casual eavesdropping.  It's no more secure,
for instance, than a poorly chosen password on UNIX if the hashed
password file is world readable -- because the time required to mount
a thorough dictionary attack on hashed passwords is similar to that 
required to BFS 40-bit RC4.  And we've seen plenty of examples of the 
former to demonstrate that such attacks are quite feasible, even commonplace.

So while I understand why netscape would like to claim that 40bit crypto
is "secure" in some sense of the word, IETF will not support such a claim.

Keith