RE: "POP3 SASL Authentication Mechanism" submitted for publication

On Mon, 15 Jan 2007, Paul Leach wrote:

> I worry that having TLS+PLAIN be the MTI sends an implicit message that
> it is "good enough". I really think that all use of plain text
> passwords, even over an encrypted tunnel to a trusted party, should be
> discouraged. (At the very least, a stern passage in the security
> considerations section is needed.) It is well known that users use the
> same password on many different servers, so TLS+PLAIN lets any such
> server act as the user to any other server.

I strongly agree with this.  In many corporate environments this sort of 
password re-use is enforced behaviour, mandated by corporate "security" 
policy.  Strange, but true.


--lyndon

   Never look at the trombones. You'll only encourage them.
   			-- Robert Strauss, on conducting