Subject: RE: [lemonade] Comments on PUSH and PULL drafts

From: "Vaudreuil, Greg M (Greg)" <[email-masked]>
Date: Tue, 2 Mar 2004 15:21:40 -0600

While submission servers can and should authenticate using per-user credentials, this still seems to be an operational exception rather than the rule.  The Pull proposal counts upon operational behavior change here, and I am not yet convinced that it is reasonable.

One possible example:

 - For ISP's and the like, the submit server lives in a DMZ-like environment where there are requirements to limit access to sensitive data like user credentials. It is more "secure" from some perspectives to authorize based on source IP address (is it on my network) than to expose and use per-user authentication. Here anti-spam and authentication database protection are somewhat at odds.

Greg V.

-----Original Message-----
From: Mark Crispin [mailto:[email-masked]]
Sent: Tuesday, March 02, 2004 1:20 AM
To: Rob Siemborski
Cc: Marcus D. Leech; [email-masked]
Subject: Re: [lemonade] Comments on PUSH and PULL drafts

On Mon, 1 Mar 2004, Rob Siemborski wrote:
> there are also ones present in a "push" model -- that is, the SUBMIT
> server needs to trust the IMAP server to submit messages on behalf of the
> user.

The security arguments that are advanced to favor PUSH over PULL all seem 
to assume that SUBMIT servers are SMTP servers with no authentication. 
Since such SUBMIT servers promiscuously trust everybody, there are no 
added security considerations in trusting an IMAP server.

Many of us are deploying SUBMIT servers which require authentication; and 
the SUBMIT authentication credentials are not necessarily the same as 
those for an IMAP server.  The PUSH model makes no attempt to acknowledge 
that such a concept exists, much less support this environment.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Tue, 2 Mar 2004 13:33:16 -0800 (Pacific Standard Time)

On Tue, 2 Mar 2004, Vaudreuil, Greg M (Greg) wrote:
> While submission servers can and should authenticate using per-user 
> credentials, this still seems to be an operational exception rather than 
> the rule.

Is that really true?  None of the submission servers that I have access to 
permit access without per-user credentials.

>  - For ISP's and the like, the submit server lives in a DMZ-like 
> environment where there are requirements to limit access to sensitive 
> data like user credentials. It is more "secure" from some perspectives 
> to authorize based on source IP address (is it on my network) than to 
> expose and use per-user authentication.

This observation may have been valid 10 years ago, but subsequent events 
have overtaken it.

The technology of IP address spoofing is well-developed and used by the 
bad guys to defeat those who believe that source IP address validation is 
good enough.

Authentication technologies exist that do not convey useful information to 
a third-party monitoring the authentication.

SSL/TLS is widely deployed, and effectively defeats monitoring.

New technology being defined today should consider the environment being 
deployed now and in the future, and not create needless dependencies on 
the environment that was deployed in the past.

-- Mark --

---

From: Steve Hole <[email-masked]>
Date: Wed, 3 Mar 2004 15:01:12 -0700

On Tue, 2 Mar 2004 15:21:40 -0600  "Vaudreuil, Greg M (Greg)" 
<[email-masked]> wrote:

> the rule.  The Pull proposal counts upon operational behavior change 
> here, and I am not yet convinced that it is reasonable.

The whole thing is an operational change Greg.  Beside, Sendmail has had 
SASL support for a long time now with all of the appropriate semantics for
doing relay forwarding in authenticated state.   Lot's of people use it 
that way for that purpose alone.

This generalization that few people are doing this way is debatable at the
very least. 

---
Steve Hole
Chief Technology Officer - Billing and Payment Systems
ACI Worldwide
<mailto:[email-masked]>
Phone: 780-424-4922