Re: Do we need IMAP/TLS or POP/TLS?

> However, in retrospect, it occurs to me that we might have good reason to
> leave IMAP and POP over TLS on a separate port. The main reason we want a
> single port for SMTP and LDAP is because clients do not necessarily have a
> previous relationship with the servers, and thus won't know whether or not
> to try the TLS port first if they want to do TLS.

There's another reason for using only one port: it makes it much
easier to configure the clients if they can automagically determine
when TLS is available.  And it's much easier to secure existing
applications protocols if new "TLS aware" clients can use the same
configuration (host, port#, etc.) as the old "pre-TLS" clients.

And no matter what the service, the "try the TLS port first and fall
back to another port" is trivially vulernable to denial-of-service
attacks on the TLS port.

The separate port idea has always been a botch and must be fixed ASAP.
I've already asked IANA to consult with the APPS ADs before defining
any more "FOO+TLS" ports for applications.

My highest priority as APPS AD is to fix as many existing apps as
possible, to negotiate TLS in-band.

Keith