Subject: Re: Privacy and IETF Document Access

From: "Robert G. Ferrell" <[email-masked]>
Date: Tue, 28 Mar 2000 13:10:37 -0600 (CST)

>If it doesn't care whether the email address is valid, why does it insist
>that the invalid email address be in the format of an email address?  The
>problem is not that it insists on a valid email address, but that it
>appears to do so.  This lack of clarity serves no recognizable purpose.

Folks, this is just a standard feature of anonymous FTP servers.  The 
authentication parser does a regexp check for string@string[.string]n as a sort 
of half-witted attempt to weed out the complete lusers.  You can take issue with 
the algorithm if you want, but it certainly doesn't qualify as an invasion of 
privacy.

RGF

Robert G. Ferrell, CISSP
Information Security Officer
National Business Center, US DoI
[email-masked]
------------------------------------------------------------
Nothing I have ever said should be construed as even vaguely
representing an official statement by the NBC or DoI.
------------------------------------------------------------

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 28 Mar 2000 21:03:09 +0100 (BST)

On Tue, 28 Mar 2000, Robert G. Ferrell wrote:

> Folks, this is just a standard feature of anonymous FTP servers. 

which shouldn't be called 'anonymous', then.

Just because it's a standard feature doesn't make it a good
idea. Speaking of invasions of privacy, I can't find where in
Navigator to set the anonymous ftp email password; looks like it's
been inherently linked to mail identity. Building mail clients into
web browsers has subtle privacy risks.

L.

> The 

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Doug Royer <[email-masked]>
Date: Wed, 29 Mar 2000 02:31:00 -0800

> web browsers has subtle privacy risks.

The IETF did not write Netscape, maybe you issue can go to them?

From fyi24.txt, rfc1635.txt

What is Anonymous FTP?

   Anonymous FTP is a means by which archive sites allow general access
   to their archives of information.  These sites create a special
   account called "anonymous".  User "anonymous" has limited access
   rights to the archive host, as well as some operating restrictions.
   In fact, the only operations allowed are logging in using FTP,
   listing the contents of a limited set of directories, and retrieving
   files.  Some sites limit the contents of a directory listing an
   anonymous user can see as well.  Note that "anonymous" users are not
   usually allowed to transfer files TO the archive site, but can only
   retrieve files from such a site.

   Traditionally, this special anonymous user account accepts any string
   as a password, although it is common to use either the password
   "guest" or one's electronic mail (e-mail) address.  Some archive
   sites now explicitly ask for the user's e-mail address and will not
   allow login with the "guest" password.  Providing an e-mail address
   is a courtesy that allows archive site operators to get some idea of
   who is using their services.

---

From: "Thomas Wolfram" <[email-masked]>
Date: Wed, 29 Mar 2000 13:32:12 +0200

> -----Original Message-----
> From: Lloyd Wood [mailto:[email-masked]]
> Sent: Tuesday, March 28, 2000 10:03 PM
> To: Robert G. Ferrell
> Cc: [email-masked]
> Subject: Re: Privacy and IETF Document Access
[...]
> web browsers has subtle privacy risks.

For Netscape try: ftp://[email-masked]
resp.: ftp://[email-masked]

---

From: Lloyd Wood <[email-masked]>
Date: Wed, 29 Mar 2000 12:43:51 +0100 (BST)

> From fyi24.txt, rfc1635.txt

[..]
>    Some archive

The courtesy of today is the privacy risk of tomorrow.

L.

---

From: "Thomas Wolfram" <[email-masked]>
Date: Wed, 29 Mar 2000 14:20:43 +0200

> From: Thomas Wolfram [mailto:[email-masked]]
> Sent: Wednesday, March 29, 2000 1:32 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: Privacy and IETF Document Access
> 
...
> resp.: ftp://[email-masked]

sorry, that should read: ftp://user:[email-masked]