Subject: [dispatch] Email Security - Flow and Mailbox

From: Bogdan Moldovan <[email-masked]>
Date: Tue, 10 Mar 2020 13:18:29 +0200

​​Axigen is commercial software for self hosting email or for mailbox hosting providers. 
It is an all in one platform. 

We therefore are very interested in both flow and mailbox access email security measures. 

We've implemented 2FA for our WebMail access.

We've been looking XOAUTH2 and OAUTHBEARER for additional mailbox access level controls. Currently, we've been also reading about CLIENTID and its draft: https://www.ietf.org/id/draft-yu-imap-client-id-03.txt

What does it take to push this forward?

	Bogdan

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 10 Mar 2020 14:38:53 +0000

Hiya,

> What does it take to push this forward?

I guess that'll depend a bit on whether the IETF f2f
meeting goes ahead, and if not, what replaces it. We
should know more about that in the coming days.

I would support having a virtual BoF for this topic
though, (meaning 2FA for IMAP and similar) should
that seem like a good plan to the dispatch/secdispatch
chairs and relevant ADs. I think there's real demand,
a real security win possible and it'd be worth finding
out if there's a mechanism that all the main service
providers would find acceptable.

Cheers,
S.

> 
> 
> 	Bogdan
> 
> 
> 
> 
> 
> 
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>

---

From: Bogdan Moldovan <[email-masked]>
Date: Tue, 10 Mar 2020 16:54:39 +0200

Hi,

> should know more about that in the coming days.
Curious to see how that unfolds... 

> providers would find acceptable.
Should such a virtual BoF be scheduled, how could I get involved? 

B/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 10 Mar 2020 15:05:20 +0000

> Should such a virtual BoF be scheduled, how could I get involved? 

Usually there'd be a mailing list announced some time
before.

S.

---

From: Bogdan Moldovan <[email-masked]>
Date: Tue, 10 Mar 2020 17:08:03 +0200

On Tue, 10/03/2020 05:05 PM, Stephen Farrell <[email-masked]> wrote:
> Usually there'd be a mailing list announced some time
Thanks, I'll keep my antennas up and running ;)

---

From: "Alexey Melnikov" <[email-masked]>
Date: Mon, 23 Mar 2020 12:36:11 +0000

Hi Bogdan,
(With my participant hat on):

On Tue, Mar 10, 2020, at 11:18 AM, Bogdan Moldovan wrote:
> Axigen is commercial software for self hosting email or for mailbox hosting providers. 
I came to conclusiom that draft-yu-imap-client-id-03.txt is a wrong way of extending IMAP and that the right approach is extending one of SASL mechanism (like XOAUTH2/OAUTHBEARER/SCRAM) or writing a new SASL mechanism. That way the same mechanism can be used across multiple protocols (e.g. IMAP, SMTP, XMPP, etc.).

Best Regards,
Alexey

---

From: Bogdan Moldovan <[email-masked]>
Date: Mon, 23 Mar 2020 15:42:32 +0200

May I ask why did you come to the conclusion that draft-yu-imap-client-id-03.txt is a wrong way of extending IMAP? Not saying it is not wrong, just curious on your reasoning. 
B

p.MsoNormal,p.MsoNoSpacing{margin:0}

---

From: "John Levine" <[email-masked]>
Date: 23 Mar 2020 11:24:41 -0400

>May I ask why did you come to the conclusion that draft-yu-imap-client-id-03.txt is a wrong way of extending IMAP? Not saying it is not wrong, just curious on your

Whatever authentication problems affect IMAP, the exact same ones affect POP and SMTP AUTH which invariably use the same credentials.

The point of SASL is to be able to use consistent authentication across different services.  A single hack to IMAP can't do that.

R's,
John