MBOX-Line: From dinh.viet.hoa at free.fr  Fri Nov 24 01:29:25 2006
To: imap-protocol@u.washington.edu
From: =?ISO-8859-1?Q?DINH_Vi=EAt_Ho=E0?= <dinh.viet.hoa@free.fr>
Date: Fri Jun  8 12:34:38 2018
Subject: [Imap-protocol] RFC 3501 section 5.4 Autologout timer
In-Reply-To: <20061123140532.C1467@gollum.dev.gmi-mr.com>
References: <OFA9534B24.F7AFC6BC-ON8825722F.0072265E-8825722F.0073EC06@ca.i
	bm.com> <alpine.OSX.0.7.0611231345060.17689@pangtzu.panda.com>
	<20061123140532.C1467@gollum.dev.gmi-mr.com>
Message-ID: <C7691B6E-40E2-4C55-B438-BB00E05161FF@free.fr>

On 23 Nov 2006, at 23:20, Lyndon Nerenberg wrote:

> On Thu, 23 Nov 2006, Mark Crispin wrote:
>
>> For what it's worth, UW imapd has a 3 minute pre-authentication  
>> autologout timer.  There are actually two pre-authentication  
>> autologout timers: the normal inactivity autologout timer, and an  
>> non-authenticated session age time which is enforced at command  
>> completion.  The latter is cancelled by a successful  
>> authentication; a session could be over-age but still within the 3  
>> minute inactivity grace, but it must authenticate at that point.  
>> The upshot is that a non-authenticated session will die between 3  
>> and 6 minutes from its startup.
>
> This addresses a concern that immediately came to mind, that of  
> someone setting a 30 second timeout. Remember that the client can't  
> prompt for a password until it knows which authentication mechanism  
> is to be used. So we wind up with a scenario like:
>
> C: 0 authenticate digest-md5
> [client asynchronously prompts user for password]
> S: + mumblefooetc ...
> [user fumbles for scrap of paper with password, then slowly types it  
> in, backspacing and correcting along the way ...]
> S: * BYE you type too slowly
> [server closes connection]
> [client terminates login attempt due to server error]

But the client will store (securely) the password locally and send it  
automatically without the user has to type the password.
The alternative for the client is to reconnect to send the password  
that was typed if the session disconnected (it will occur once while  
the password is still valid if the password is stored on client-side  
(hopefully passwords don't change too often)).

-- 
DINH Vi?t Ho?


