🚀 go-pugleaf

In article <1992Aug14.173113.5978@fwi.uva.nl> casper@fwi.uva.nl (Casper H.S. Dik) writes:
>I don't understand what all this complaining against RFC 931 is about.

First of all it seems like not many sites are running RFC 931 type
code. I don't know why this is, but it makes it considerably harder to
count on it for authentication. 

I do think RFC 931 would improve security on the Internet, but not by
very much..

Quoting from RFC 931:

"Unfortunately, the trustworthiness of the various host systems that
might implement an authentication server will vary quite a bit.  It is
up to the various applications that will use the server to determine
the amount of trust they will place in the returned information."

No kidding. I don't trust root@some.site at all. I don't let root NFS
mount my disks, I don't let root rsh to my machine. In particular, I
don't trust anything a restricted port tells me.

Why don't I trust root? I don't know you. And, on the majority of UNIX
machines it is fairly simple for any user to become root.

It is likely that RFC 931 style authentication would be useful in
stopping most forged mail - not many people are going to bother
hacking root just to forge a letter. But as a general protection
scheme it is not very useful.
-- 
                __
nelson@reed.edu \/    The look in his eyes when it hit - kid, it was tasty...