Re: [art] Auto-configuring Email Clients via WebFinger

[Steffen Nurpmeso <[e-mail]>]

Arnt Gulbrandsen wrote in <9c6cde19-be14-4d13-9194-eff01770a61e@gulbrand\
sen.priv.no>:
 |On Thursday 18 July 2019 07:17:55 CEST, John Levine wrote:
 |>> In the end i will have to implement actions aka "clickable" URLs
 |>> for a text-mode mail reader.
 |>
 |> I don't understand that at all.  Why would you need to do that?
 |
 |It sounds as if Steffen hasn't looked at Thunderbird autoconfiguration, at 
 |all, and is arguing that something else would be bad.
 |
 |BTW, Thunderbird is unlikely to be the only client that uses its scheme. 
 |The relevant stack overflow questions overwhelmingly point to the 
 |Thunderbird scheme.
 |
 |https://stackoverflow.com/search?q=%5Bimap%5D+autoconfiguration
 |https://stackoverflow.com/search?q=%5Bmail%5D+autoconfiguration

The final pages [1] and [2] would benefit from an update, to me
direct TLS connection via POP3S/SUBMISSIONS etc. are not
"old-style", but i personally prefer them over STARTTLS/STLS etc.
Also "remove the following and leave to client/user?" and "<!--
not yet supported -->" i would like to know the final outcome of
before possibly writing code and having the need to start linking
against expat in order to get this stuff right.

I personally fail to see the value in not making that a plain
UTF-8-by-definition text file in Windows resource file format,
maybe [section.subsection] or [section/subsection] so to group the
key/value pairs, and # comments.  It has to be XML / JSON / CBOR.
(I would go for the latter two if plain text is not feasible.
That is a ~500 line C code parser at maximum, which does not count
for such a feature, especially in a codebase like Thunderbird.)

  Please support authentication with CRAM-MD5. It is simple to
  implement, and to set up, and you can still use RADIUS or
  a database that stores passwords in plaintext, so you don't need
  ...

  As an ISP, you should ideally store passwords in encrypted
  format, which removes the risk of mass password theft (and
  possibly reuse on other sites) if somebody hacks your
  servers. You can still support plaintext passwords in this case,

It is often wise to reiterate things in public!
Please do not store the passwords on a server that is exposed to
the internet, get it from an internal server via TCP/TLS or
whatever; maybe the internal service could require a client
certificate before responding, that would be nice.  (I am not an
administrator, i really lack that much of knowledge for being
a good one even, but i became a bit frightened.)

  [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration/FileFormat/HowTo
  [2] https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat

So many things are moving to .well-known now.  If this here
passes, then maybe S/MIME certificates via .well-known are not
that far away, too.  (My German passport does not offer any keys
or certificates for digital credentials, which is very sad.)

Personally i do not understand why this cannot be in DNS.  I have
seen SRV being brought up, and isn't that exactly the information
that DNS is designed for?

And all the best to your wife, Mr. Cridland!

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)