re: New version of TLS + IMAP/POP/ACAP draft

On Thu, 19 Nov 1998 10:31:19 -0800 (PST), Chris Newman wrote:
> Since I believe the primary use of TLS for these protocols will be in
> combination with clear-text passwords, I've added a "clear-text password
> requirement".  This requires a server that implements both STARTTLS and a
> clear-text mechanism (including IMAP LOGIN, POP3 PASS, and PLAIN) to
> have an operational mode where all clear-text login commands and
> mechanisms are disabled unless TLS encryption is active.

Chris, I have already told you that I do not consider the current wording to
be acceptable.  You are, in effect, adding another clear-text password
mechanism to be transmitted unencrypted over the network.

It should be an absolute requirement that the PLAIN mechanism be disabled,
unannounced, and unavailable unless TLS encryption is active.  This is
completely independent of what is done with IMAP LOGIN or POP3 PASS.

By your own admission, your "clear-text password requirement" is worthless.
You have admitted that a POP3 server which does not have PASS, or an IMAP
server which does not have LOGIN, will not function well in the overwhelming
majority of contemporary installations.

That is not an excuse for allowing PLAIN in a non-TLS session.  The
requirement already exists for doing a new CAPABILITY command after STARTTLS.
Why, then, do you feel compelled to allow PLAIN in a non-TLS session?

Furthermore, as I also discussed with you, the syntax of the data transmitted
in PLAIN is quite poorly designed.  PLAIN has the concept of a separate
authorization and authentication identity.  In actuality, the authorization
identity is optional and gets defaulted from the authentication id.  Instead
of this optional field coming after the mandatory fields (opening the
possibility that it not be sent at all), it is the first field.  Without a
careful reading, a programmer is misled to believe that the arguments to PLAIN
are
	username NUL password
or	username NUL NUL password
instead of what PLAIN actually wants, which is
	NUL username NUL password