Re: Do we need IMAP/TLS or POP/TLS?

--On Sun, Jun 1, 1997 3:23 PM -0700 "Paul E. Hoffman"
<[email protected]> wrote: 

> The only exception I can think of is public, anonymous IMAP
mailboxes. In
> this case, however, you wouldn't be using TLS, since there is no
> authentication and no need for privacy.

To add to what Chris wrote, I note that I might want integrity
protection and authentication of the server when I go to a public site,
even if I don't care about privacy.  Repeat after me:  TLS is not just
about encryption ...

Furthermore, I wouldn't equate public and anonymous.  We've all seen
lots of "public" web sites that ask us to register in order to use
them.  I might well go to a public IMAP server looking for something,
and it would ask me to authenticate using TLS, and I would do so using
my credit-card-based certificate since I want to see what it has and I
don't care if it knows who I am.  It would be nice for this scenario to
work via IMAP-protocol-based negotiation.

As we've discussed on the ASID list, the two-port scheme really hoses
URLs.  This is reason enough to avoid it in just about any protocol,
IMHO.  If it's worth doing a protocol on TLS, it's worth doing it right
and integrating it with the rest of the protocol's operations.

 - RL "Bob"