IETF Logo Mail Archive

Re: Some security-related suggestions

Steve Dorner <sdorner@qualcomm.com> Wed, 08 June 1994 23:24 UTC

Received: from ietf.nri.reston.va.us by IETF.CNRI.Reston.VA.US id aa08504; 8 Jun 94 19:24 EDT
Received: from CNRI.RESTON.VA.US by IETF.CNRI.Reston.VA.US id aa08500; 8 Jun 94 19:24 EDT
Received: from ANDREW.CMU.EDU by CNRI.Reston.VA.US id aa17404; 8 Jun 94 19:24 EDT
Received: (from postman@localhost) by andrew.cmu.edu (8.6.7/8.6.6) id TAA16945; Wed, 8 Jun 1994 19:20:42 -0400
Received: via switchmail for ietf-pop3+@andrew.cmu.edu; Wed, 8 Jun 1994 19:20:42 -0400 (EDT)
Received: from po5.andrew.cmu.edu via qmail ID </afs/andrew.cmu.edu/service/mailqs/q001/QF.ohxZ7Na00UddEISU4T>; Wed, 8 Jun 1994 19:18:50 -0400 (EDT)
Received: from ux1.cso.uiuc.edu (ux1.cso.uiuc.edu [128.174.5.59]) by po5.andrew.cmu.edu (8.6.7/8.6.6) with SMTP id TAA05235 for <ietf-pop3+@andrew.cmu.edu>; Wed, 8 Jun 1994 19:18:40 -0400
Received: from dorner.slip.uiuc.edu by ux1.cso.uiuc.edu with SMTP id AA20505 (5.67b8/IDA-1.5 for <ietf-pop3+@andrew.cmu.edu>); Wed, 8 Jun 1994 18:18:10 -0500
Received: from [192.17.5.3] by dorner.slip.uiuc.edu with SMTP id AA00931 (5.67b/IDA-1.5 for <ietf-pop3+@andrew.cmu.edu>); Wed, 8 Jun 1994 18:18:11 -0500
X-Sender: sdorner@192.17.5.1
Message-Id: <aa1bfee60502101648a5@[192.17.5.3]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 08 Jun 1994 18:18:04 -0500
To: ietf-pop3+@andrew.cmu.edu
Sender: ietf-archive-request@IETF.CNRI.Reston.VA.US
From: Steve Dorner <sdorner@qualcomm.com>
Subject: Re: Some security-related suggestions

How about we just add:

  SECURITY CONSIDERATIONS:

  Servers that answer -ERR to USER commands with invalid usernames
  are giving clues about valid usernames to hackers.

  Use of the PASS command sends passwords in the clear over the network.

  Use of the RETR command sends mail in the clear over the network.

Then we cover the bases by noting the security problems.  Less work just to
add these than to argue about whether we ought to have to add them.

--
Steve Dorner, Qualcomm Incorporated
 "There's nothing wrong with you that can't be cured
  with a little Prozac and a polo mallet." - Woody Allen

v2.23.0 | Report a Bug | By Email