Re: Do we need IMAP/TLS or POP/TLS?

Bob,

RL "Bob" Morgan @networking.stanford.edu wrote:
> 
> --On Sun, Jun 1, 1997 3:23 PM -0700 "Paul E. Hoffman"
> <[email protected]> wrote:
> 
> > The only exception I can think of is public, anonymous IMAP
> mailboxes. In
> > this case, however, you wouldn't be using TLS, since there is no
> > authentication and no need for privacy.
> 
> To add to what Chris wrote, I note that I might want integrity
> protection and authentication of the server when I go to a public site,
> even if I don't care about privacy.  Repeat after me:  TLS is not just
> about encryption ...
> 
> Furthermore, I wouldn't equate public and anonymous.  We've all seen
> lots of "public" web sites that ask us to register in order to use
> them.  I might well go to a public IMAP server looking for something,
> and it would ask me to authenticate using TLS, and I would do so using
> my credit-card-based certificate since I want to see what it has and I
> don't care if it knows who I am.  It would be nice for this scenario to
> work via IMAP-protocol-based negotiation.

  I see your point and agree.  I would also take it one step further,
that being that there should not necessarly be any tie to ANY protocol
in particular.  This can be achieved is several ways, which I have
posted befor and WE chose to develope and "Interface Facility" (MLPI)
for just this and other perposes.  :)
> 
> As we've discussed on the ASID list, the two-port scheme really hoses
> URLs.  This is reason enough to avoid it in just about any protocol,
> IMHO.  If it's worth doing a protocol on TLS, it's worth doing it right
> and integrating it with the rest of the protocol's operations.

  I agree.  See my comment just above.  :)
> 
>  - RL "Bob"

Regards,
-- 
Jeffrey A. Williams
DIR. Internet Network Eng/SR. Java Development Eng.
Information Eng. Group. IEG. INC. 
Phone :913-294-2375 (v-office)
E-Mail [email protected]