Re: Some security-related suggestions

[Michael D'Errico <[e-mail]>]

>[e-mail] (Michael D'Errico) writes:
>> All of my mail goes out as "mike" but I can set up a POP account for
>> me as "2Yhd%0_" if I want....
>
>Or you could alternately leave your account as "mike" and require your
>password to start with "2Yhd%0_", with no increase in security risk.
>Two reusable passwords are no better than one twice as long.

Well the reason for this is that users generally pick easily guessable
passwords, so if you pick an obscure user name for them, you have in-
creased the security of their account.  Of course there is no security
if people can sniff your local network though.

>If people want text like that given by Steve Dorner in the Security
>Considerations section, fine.  I do, however, object to prohibiting
>servers from issuing useful error messages on the USER command.

My only intention in posting the original message was to have a section
on Security Considerations that said anything other than "Security
issues are not discussed in this memo."  The text proposed by Steve,
along with that in mrose-again (about APOP), does exactly that.

Michael D'Errico
[e-mail]