POP3 authentication

Thread View: demon.ip.developers

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Mike Mann Thu, 01 Jan 1998 00:00

#349

Author: Mike Mann
Date: Thu, 01 Jan 1998 00:00

31 lines
1812 bytes

Life is becoming complicated for developers of POP3 clients.  As well
as the standard USER / PASS clear text scheme, there seem to be
several alternative means of authenticating:

o  The APOP command defined in RFC 1939, which uses encryption based
   on the MD5 algorithm described in RFC 1321.

o  Remote Passphrase Authentication (RPA), described in
   http://www.compuserve.com/rpa/rpadtails.htm, which is now used by
   Compuserve.

o  Secure Password Authentication (SPA) using the AUTH command, which
   is the only authentication method supported by MSN's POP3 servers.

I haven't been able to find any references to SPA although the POP3
AUTH command is described in RFC 1734 which refers to IMAP-AUTH which
seems to be described in RFC 1730 and others.

Can anyone confirm whether SPA on POP3 is indeed the mechanism
described in RFC 1734 and ideally provide some further references?
Any opinions on the likely take-up of the alternative authentication
methods would also be appreciated.

Many thanks and Seasons Greetings.

Regards, Mike.

-- 
Home: mike@kempston.demon.co.uk | kempston@netcomuk.co.uk
PGP 2.6.2i public key available by mail from pgp@kempston.demon.co.uk

Re: POP3 authentication

#352

Author: madcat
Date: Sat, 03 Jan 1998 00:00

30 lines
1746 bytes

Mike Mann <mike@kempston.demon.co.uk> wrote the following: 

: Life is becoming complicated for developers of POP3 clients.  As well
: as the standard USER / PASS clear text scheme, there seem to be
: several alternative means of authenticating:

: o  The APOP command defined in RFC 1939, which uses encryption based
:    on the MD5 algorithm described in RFC 1321.

: o  Remote Passphrase Authentication (RPA), described in
:    http://www.compuserve.com/rpa/rpadtails.htm, which is now used by
:    Compuserve.

: o  Secure Password Authentication (SPA) using the AUTH command, which
:    is the only authentication method supported by MSN's POP3 servers.


There is also Kerberos authentication for POP3, although I don't know if
this falls under the above mentioned three. 

I for one still use the normal USER/PASS sequence in any program I write
that has to do something with POP3. I just don't see the use of all the
other things. (Okay, maybe because your password flies over the line
unencrypted.)

-- 
Bernhard van Staveren 	     ----       Mungled headers, addresses below.
home:	madcat(at)superunknown.ml.org   work: staveren(at)xirian.demon.nl
"Linux, WinNT and MS-DOS. The Good, The Bad and The Ugly"

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads