Subject: Re: [imapext] LOGINDISABLED

From: Bron Gondwana <[email-masked]>
Date: Sun, 07 Jul 2013 22:20:01 +1000

[sorry again for late replies]

On Sat, Jun 8, 2013, at 03:02 AM, Ken Murchison wrote:
> On 06/07/2013 12:59 PM, Cyrus Daboo wrote:
> > Hi,
> > RFC3501 defines a LOGINDISABLED property that is used prior to 
> > STARTTLS (or some out of band security) being in place to ensure the 
> > LOGIN command is not used in an insecure environment. Some servers 
> > also offer configuration to also disable plain text authentication 
> > even when a security layer is in place. In that situation, should 
> > (must) the server advertise LOGINDISABLED in capabilities sent after 
> > STARTTLS? The spec really does not cover that case explicitly.
> >
> > Personally I think anytime the server is going to reject LOGIN it 
> > ought to advertise LOGINDISABLED to ensure clients don't "blindly" 
> > send the clear text credentials - because the purpose of disabling 
> > LOGIN is to stop that happening in the first place 
> 
> +1

We found that the average half-arsed client sent the credentials without
even looking at the capabilities.

Plus any half-dedicated man in the middle is going to strip LOGINDISABLED
from the capabilities response anyway.

So, nice idea - but it's not a security method.  Which is why we only
allow SSL on port 993 now.

Bron.

-- 
  Bron Gondwana
  [email-masked]