MBOX-Line: From lyndon at orthanc.ca  Tue Mar 18 18:39:49 2014
To: imap-protocol@u.washington.edu
From: Lyndon Nerenberg <lyndon@orthanc.ca>
Date: Fri Jun  8 12:34:52 2018
Subject: [Imap-protocol] STARTTLS after PREAUTH
In-Reply-To: <1395187453.9897.96141249.7BE88CD8@webmail.messagingengine.com>
References: <20140318141305.Horde.iyy0UP8Ostx9TojRZiFyjw1@bigworm.curecanti.org>
	<059bac1f-35eb-4f87-bd5e-e986dfb46b83@flaska.net>
	<20140318152549.Horde.0C2tXb4vwx_29xt0ZbwdEQ4@bigworm.curecanti.org>
	<1395187453.9897.96141249.7BE88CD8@webmail.messagingengine.com>
Message-ID: <08C9B4E3-B0C3-40B3-AF7A-1B29FA09A0C9@orthanc.ca>


On Mar 18, 2014, at 5:04 PM, Bron Gondwana <brong@fastmail.fm> wrote:

> I can't understand how STARTTLS ever got floated as an idea.  It's totally insane.

Damn you and your 20/20 hindsight!  Care to lend us your waybac machine?  :-)

Anyway, if you think STARTTLS is horrific, you really don't want to know about the adventures surrounding the early implementations of AUTH ...

The bottom line is that breaking every existing IMAP client and server wasn't a practical way to move forward.  And the various authentication bits in IMAP rolled out just at the end of the 'naive' age of the 'we are all friends' internet.  They were (are) incremental improvements to the situation as it existed.  Breaking existing clients/servers was not an option.  The best you can hope for is to offer better alternatives, encourage adoption, and hope attrition eventually solves the problem.

Which it never will, but almost two decades after the fact, anyone using, or inflicting upon someone, an IMAP client that blindly issues LOGIN is perhaps deserving of their fate.  C'est la vie.

--lyndon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 817 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://mailman13.u.washington.edu/pipermail/imap-protocol/attachments/20140318/e96a3f06/attachment.sig>
