Re: [EAI] POP/IMAP authentication?

Yes Barry, you said it better than I did.

I believe that some (not all) systems may want to permit ASCII-only AND Unicode authentication because a) Presumably Unicode is "easier" for the user (why we're doing this work), but b) Their mail client or phone or whatever may be restricted to ASCII for now.

Your text conveys the idea, it's not just migration though, it could be new accounts.  Also I only think it's informational, some apps may not need the handle this scenario.  Maybe ?

------
When a user creates a new Unicode account, or migrates an existing ASCII account to Unicode, applications need to consider the appropriate authentication needs for those users.  Some users may desire Unicode login information, yet be restricted to ASCII devices or clients.  In those cases, systems may choose to provide both a Unicode and an ASCII authentication mechanism.  This is not required, and systems may assign logon credentials as they see fit, however it is recommended that application developers carefully consider the use cases and needs of the end users to determine if ASCII and/or Unicode credentials are required.

Certain limitations may impact decisions about logon credentials:  Keyboards available to the user, anticipated public terminal use like kiosks or internet cafes, software limitations such as legacy mail clients, and hardware limitations such as cellular or satellite phones.

-Shawn

-----Original Message-----
From: Daniel Taharlev [mailto:daniel@taharlev.com]
Sent: Tuesday, July 14,  2009 8:22
To: barryleiba@computer.org; Shawn Steele
Cc: ima@ietf.org
Subject: Re: [EAI] POP/IMAP authentication?

Many of my users also have different machines with different keyboard layouts, and accounts set on several machines, it's not just a mobile phone issue imho... Be gentle it's my first post

daniel@taharlev.com

-----Original Message-----
From: Barry Leiba <barryleiba.mailing.lists@gmail.com>

Date: Tue, 14 Jul 2009 11:19:15
To: Shawn Steele<Shawn.Steele@microsoft.com>
Cc: ima@ietf.org<ima@ietf.org>
Subject: Re: [EAI] POP/IMAP authentication?

I think what Shawn's getting at, which Alexey and Harald haven't
addressed and which Shawn might not be making clear, isn't so much the
connection between the IMAP login and the email address as it is the
idea of limitations on, say, the user's device.

If I'm migrated to a new email address and if, in the process, I also
get a nifty new non-ASCII login (whether or not it's the same as the
email address... surely we can see that migrating both at the same
time might be a common thing), that may be OK when I'm using my
laptop, where I can enter, say, "лзыба" just fine.  But I might not
have a mobile phone yet that can enter Cyrillic letters (or Thai
characters, or whatever), and then I'd have a hard time logging in
from my mobile.

And I think Shawn's point, which I agree with if I'm getting that
right, is that it wouldn't be a bad thing to point that out and to
suggest that an ASCII version of the login be available for a
transition.  Perhaps some text vaguely like this:

---
When a user's email address is changed, it may be common -- perhaps
desirable -- to change the user's login identification as well.  It's
possible, however, that a user who gets a non-ASCII email address
might still have devices that are unable to enter a non-ASCII login
ID.  It is probably wise, therefore, to continue to accept an ASCII
version of the user's login ID -- perhaps the old one, or perhaps an
alternate ASCII version of the new one -- until the user confirms that
it is no longer necessary.
---

Barry
_______________________________________________
IMA mailing list
IMA@ietf.org
https://www.ietf.org/mailman/listinfo/ima