Re: Some security-related suggestions

[Ned Freed <[e-mail]>]

> I consider these all implementation issues.  There's no reason to
> require these measures in the spec.

Actually, there is. Current IESG rules state that all known "security issues"
associated with a protocol must be discussed. Actually recommending solutions
to problems is not required, but a description of the issues is. However, if
you say

   "Providing an indication of the existence of an account in the absence of
   a proper password lets attackers narrow the search to known accounts, and
   thus represents an increased security risk." 

which could very well be construed by the IESG as being required, but then you
don't say that the way to prevent it from happening it to not acknowledge the
nonexistance of a username, you're being kind of stupid, don't you think?

Having seen several effective attacks based on nothing more than examination of
server process characteristics after a user-password sequence has been entered,
I for one don't think this sort of prose is at all unreasonable. In fact, I
know of one attack that actually managed to ferret out the password one
character at a time by looking at certain system statistics.

Finally, having gone through all of this with MIME, where the section on
PostScript security was written for very similar reasons, I see no need to
repeat the process and incur additional delays with POP3.

				Ned