Subject: Re: Expiring Passwords

From: John Haxby <[email-masked]>
Date: Mon, 5 Jan 1998 11:20:25 +0000

Barry Leiba wrote:
>   On Mon, 29 Dec 97 16:44:07 -0800 Paul Hoffman / IMC wrote:
>   > I would tend to want to define this in SASL rather than outside
>   > for the simple reason that it would be easier for someone who had
>   > already
>
>   Absolutely - in SASL.  To my mind, changing the authentication
>   credentials is *part* of the authentication process; it's not
>   peripheral to it.  A mechanism for making that change should be part
>   of the authentication layer.

Yup.  As we've already seen, if the credential changing mechanism isn't part
of the authentication layer then people will develop their own ad hoc
solutions in response to customer demand.  Sometimes these mechanisms are
good and provide good protection for the new credentials.  Sometimes the
mechanisms are rather weaker than the authentication mechanism and open up
unpleasant new loopholes.  This is self-evident.

What I, personally, would really really like to see is a secure credential
changing mechanism that does not use algorithms that are subject to export
licensing controls.  Everything I've thought of requires use of encryption
which automatically makes it subject to export licensing controls, either US
or UK ones.

--
John Haxby
OpenMail R&D

---

From: John Haxby <[email-masked]>
Date: Mon, 5 Jan 1998 11:20:25 +0000

--
John Haxby
OpenMail R&D