Subject: Privacy and IETF Document Access

From: Tim Salo <[email-masked]>
Date: Tue, 28 Mar 2000 08:42:48 -0600 (CST)

I recently noticed that ftp.ietf.org requires the use of an e-mail
address (well, ok, something that looks like an e-mail address) as
a password for anonymous login.  (see sample below)

I suggest that:

o	The IETF, consistent with its traditional concern about
	network privacy, disable this feature and allow anonymous
	access to documents without requiring an e-mail-like password,

o	Explain why e-mail addresses are being collected from anonymous
	ftp users, and

o	Explain who has had access to the list of e-mail addresses.

-tjs

[Geez.  This is the organization that (appropriately) declined to
standardize wiretapping solutions, but collects information about everyone
who accesses its documents???]

% ftp ftp.ietf.org
Connected to www2.ietf.org.
220 www2 NcFTPd Server (licensed copy) ready.
Name (ftp.ietf.org:salo): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
530-You must supply a valid email address as your password.
530-For example, "[email-masked]" is okay.
530 Login failed.
ftp: Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
550 Login first, then I might let you do that.
421 Disconnecting you since you didn't login successfully within 15 seconds.
ftp>

---

From: [email-masked]
Date: Tue, 28 Mar 2000 23:31:04 +0800 (SGT)

[ From: [email-masked] ][ Date: 08:42 (-0600), Mar 28, 2000 ]

    > I recently noticed that ftp.ietf.org requires the use
    > of an e-mail address (well, ok, something that looks
    > like an e-mail address) as a password for anonymous
    > login.  (see sample below)
    > 
    > I suggest that:
    > 

I do not think this is really a concern because the system will
accept "[email-masked]" as a valid password email as well.

/amlan.

---

From: chris d koeberle <[email-masked]>
Date: Tue, 28 Mar 2000 11:58:58 -0500 (EST)

> accept "[email-masked]" as a valid password email as well.

If it doesn't care whether the email address is valid, why does it insist
that the invalid email address be in the format of an email address?  The
problem is not that it insists on a valid email address, but that it
appears to do so.  This lack of clarity serves no recognizable purpose.

-=I would imagine that if 1000 Rwandan's were hacked to death AT THE EXPO,
people would sure have raised a stink.=-

---

From: Ross Finlayson <[email-masked]>
Date: Tue, 28 Mar 2000 22:47:07 -0800

>accept "[email-masked]" as a valid password email as well.

A quick reminder here: Should you ever want to use a 'bogus' or or 
'example' domain name, please use the domain name "example.com", which the 
IANA has specifically reserved for this purpose.  (Note, BTW, that the 
domain name "fool.com" that you used as an example is actually a real 
domain name used by someone else - "Motley Fool" in this case.)

This is something that I'm particularly sensitive to, because - for some 
reason - lots of people like to use my domain name ("live.com") when 
fabricating bogus email addresses - and as a result shitloads of spam ends 
up coming my way.

         Ross.

ps. I've found that most FTP servers will accept the string "guest@" in 
addition to a fully-formed email address.