MBOX-Line: From slusarz at curecanti.org  Wed Mar 19 12:21:59 2014
To: imap-protocol@u.washington.edu
From: Michael M Slusarz <slusarz@curecanti.org>
Date: Fri Jun  8 12:34:52 2018
Subject: [Imap-protocol] STARTTLS after PREAUTH
In-Reply-To: <53608755-7559-4845-8023-d929dfb6e74c@gulbrandsen.priv.no>
References: <059bac1f-35eb-4f87-bd5e-e986dfb46b83@flaska.net>
	<fcf9f696-1314-4110-9495-24a22ce91ba8@gulbrandsen.priv.no>
	<f0f9f8a9-62fb-4220-b998-bc2092cb5144@flaska.net>
	<53608755-7559-4845-8023-d929dfb6e74c@gulbrandsen.priv.no>
Message-ID: <20140319132159.Horde.CpARW7j5F6OgSt8te3iCaA1@bigworm.curecanti.org>

Quoting Arnt Gulbrandsen <arnt@gulbrandsen.priv.no>:

> On Wednesday, March 19, 2014 12:56:08 PM CEST, Jan Kundr?t wrote:
>> Oops. Thanks for an excellent suggestion, Arnt. It turns out that  
>> Trojita silenty fails to establish encryption when the remote  
>> server greets us with an initial PREAUTH.
>
> PREAUTH is a trouble magnet, IMNSHO. The protocol would have been  
> better off without it.

Agreed.  And (unlikely scenario, but...) what can you do if you want  
to auth as another user?  You will never get the chance.  Also the  
fact you don't even know what user you are preauth'd as.

Wondering if it makes sense for our library to reject PREAUTH by  
default due to some of these issues.

michael


