From: "Jeff Stephenson" <jeffstep@microsoft.com>
To: <perry@piermont.com>
Cc: <drums@cs.utk.edu>
Subject: Re: TURN and disconnected SMTP with dynamic IP addresses 
Date: Tue, 23 Sep 1997 12:45:39 -0700
Message-ID: <01bcc859$453e5a10$abe8379d@cassatt.cassatt.dns.microsoft.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

-----Original Message-----
From: Perry E. Metzger <perry@piermont.com>
To: Jeff Stephenson <jeffstep@microsoft.com>
Cc: drums@cs.utk.edu <drums@cs.utk.edu>
Date: Tuesday, September 23, 1997 9:55 AM
Subject: Re: TURN and disconnected SMTP with dynamic IP addresses


>I'm very serious here. If anyone tries reviving TURN for this purpose
>until AFTER we have a deployed security mechanism -- note *deployed*
>-- I will personally recruit security geeks to fill this mailing list
>with flames until the point gets driven home.


Instead of that, why don't we all try and work as a community to come up
with a solution to a very immediate real-world problem?

>Spoofing is trivial.

To do, yes.

>Stealing someone's mail is not.

Exactly, which is why TURN must not be honored unless the client's identity
has been established.  A SASL based AUTH mechanism can do so.

>Spoofing is also solvable in protocols that are deployed and running today.

I'm not aware of any way of preventing it in SMTP.