From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: "Stephen J. Turnbull" Newsgroups: gmane.emacs.devel Subject: Re: POP3 password in plaintext? Date: Thu, 02 Oct 2014 10:58:10 +0900 Message-ID: <87bnpvutal.fsf@uwakimon.sk.tsukuba.ac.jp> References: <878ul1x4kw.fsf@uwakimon.sk.tsukuba.ac.jp> <87ppecv3pj.fsf@uwakimon.sk.tsukuba.ac.jp> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-Trace: ger.gmane.org 1412215123 27486 80.91.229.3 (2 Oct 2014 01:58:43 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 2 Oct 2014 01:58:43 +0000 (UTC) To: emacs-devel@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Thu Oct 02 03:58:36 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XZVf9-0006Eo-1o for ged-emacs-devel@m.gmane.org; Thu, 02 Oct 2014 03:58:35 +0200 Original-Received: from localhost ([::1]:59678 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XZVf8-00056o-M1 for ged-emacs-devel@m.gmane.org; Wed, 01 Oct 2014 21:58:34 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:46961) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XZVes-00056j-1F for emacs-devel@gnu.org; Wed, 01 Oct 2014 21:58:24 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XZVem-0007YY-4X for emacs-devel@gnu.org; Wed, 01 Oct 2014 21:58:17 -0400 Original-Received: from shako.sk.tsukuba.ac.jp ([130.158.97.161]:58012) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XZVel-0007YS-QH for emacs-devel@gnu.org; Wed, 01 Oct 2014 21:58:12 -0400 Original-Received: from uwakimon.sk.tsukuba.ac.jp (uwakimon.sk.tsukuba.ac.jp [130.158.99.156]) by shako.sk.tsukuba.ac.jp (Postfix) with ESMTP id 512A31C38EC for ; Thu, 2 Oct 2014 10:58:10 +0900 (JST) Original-Received: by uwakimon.sk.tsukuba.ac.jp (Postfix, from userid 1000) id 434221A2697; Thu, 2 Oct 2014 10:58:10 +0900 (JST) In-Reply-To: X-Mailer: VM undefined under 21.5 (beta34) "kale" acf1c26e3019 XEmacs Lucid (x86_64-unknown-linux) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 130.158.97.161 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:174922 Archived-At: Ted Zlatanov writes: > On Wed, 01 Oct 2014 13:00:56 +0900 "Stephen J. Turnbull" wrote: > > SJT> It's not clear to me that there's a good way to do it. Perhaps having > SJT> the `password-read' function (and any other functions that are used to > SJT> read passwords) check for unencrypted connections and warn the user > SJT> would work. > > I think you mean `open-network-stream'? No, I really do mean "password-read". Mostly because not all protocols demand authentication immediately on opening a stream. Eg, many sites can be accessed with HTTP, will switch to HTTPS without authentication of the client, then present an HTML document for login. > DC> configures the server name and port. In this day and age it might make > DC> sense to have such a [use TLS or fail] checkbox default to "on". > > I agree for most protocols, now that almost all our platforms support +1 > GnuTLS. I think it would also help to have a certificate manager UI, > especially for self-signed certificates. I'd like to work on it after > the impending release. I think the self-signed cert manager should default to one-time-only or a short local expiration (1 hour? 1 day?) even if the cert is long-lived. Self-signature means that the server doesn't care to devote much financial resources to security (which may be correlated with carelessness concerning other security resources), and it's quite possible that some of those will be evil sites, recognized as such by user intuition, and I'd prefer to be warned about them on a second approach.