Subject: [lemonade] draft-siemborski-imap-sasl-initial-response

From: Chris Newman <[email-masked]>
Date: Thu, 19 Apr 2007 09:50:08 -0700

During discussion of this document, Tim Polk raised the issue that there is no 
way for IMAP to distinguish between authentication errors that lead to 
different client UI behaviors (akin to RFC 3206).  I agree with his concern but 
felt the problem is with the IMAP base specification, and this document does 
not change the situation.  So we're not blocking this document.

However, I would like someone from the IMAP community to do an individual 
submission with status codes for the IMAP server to at least distinguish 
service failures from a mistyped password.  This can reduce service calls which 
I'm sure is a concern for customers of the lemonade WG.

Text could be lifted from:
  <http://tools.ietf.org/html/draft-newman-auth-resp-00>
although I recommend a less ambitious approach (akin to RFC 3206) so it gets 
completed this time :-).

Volunteers?

                - Chris Newman
                Applications Area Director

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade
Supplemental Web Site:
http://www.standardstrack.com/ietf/lemonade

---

From: Mark Crispin <[email-masked]>
Date: Thu, 19 Apr 2007 10:03:31 -0700

On Thu, 19 Apr 2007, Chris Newman wrote:
> service failures from a mistyped password.  This can reduce service calls 
> which I'm sure is a concern for customers of the lemonade WG.

What a can of worms this opens!

We do need to distinguish between "service failures" vs. "authentication 
failure and this is what you need to do to fix it" vs. "we don't like the 
authentication", since in the latter case we may wish to be somewhat 
tight-lipped as to the reason (e.g., "too many failures in too short a 
time from your IP address").

For password expiration (which presumably should be disclosed to the 
user), wouldn't the ALERT mechanism is more suitable since clients may 
disregard status codes?  That's what we use.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.
Si vis pacem, para bellum.

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 19 Apr 2007 19:16:55 +0200

Chris Newman writes:
> However, I would like someone from the IMAP community to do an 
> individual submission with status codes for the IMAP server to at 
> least distinguish service failures from a mistyped password.  This 
> can reduce service calls which I'm sure is a concern for customers of 
> the lemonade WG.

I would be happy to do that. I've wanted that for a long time (at least 
if what you mean is what I want).

Arnt