Subject: regarding authentication IDs...

From: "Jack De Winter" <[email-masked]>
Date: Tue, 08 Jul 1997 14:30:08 -0400

okay, this may sound stupid, but bear with me...

when we are adding SASL support to a layer like IMAP, POP3,
or ACAP, it is easy to establish the identity of the remote
user, and assign priviledges.  Encryption just bolsters
security.

Now, if we are doing this at the transport level, say SMTP,
is authentication pretty useless?  If not, what kind of authentication
should we all be promoting between SMTP servers?  I can see the
encryption having a strong case, but even in those cases, there
might need to be some keys exchanged and this issue of 'identity'
may come up again.

regards,
Jack

p.s. Almost forgot, if you are submitting a message into a system
using SMTP, then the above is easy.  It's more of the 'once I have
submitted the message' case that I am concerned with.
-------------------------------------------------
Jack De Winter - Wildbear Consulting, Inc.
(519) 884-4498		http://www.wildbear.on.ca/

Author of SLMail for 95 & NT (http://www.seattlelab.com/)