Internetworkers: http://www.ibiblio.org/internetworkers/

[Scott Russell <scottrus AT ipass.net>]

On Tue, Jun 10, 2003 at 05:19:26PM -0400, machett AT ibiblio.org wrote:
> 
> sorry for the repost, but I think this got lost over the weekend.  I really 
> could use the technical help on this one...
> 
> -Alan
> 
> 
> On Fri, 6 Jun 2003 12:29:03 -0400, I said:
> >
> >Being the clueless wonder that I am, I have yet another question for 
> >anyone who has the obvious answer that I haven't learned yet...
> >
> >Scenario:
> >Jane has accounts on both the Black and the White servers.
> >the White server is SSL enabled.
> >the Black server is not, and Jane's INBOX resides there.
> >Jane wants to use kmMail securely.
> >Jane cannot receive mail at the White server.
> >Jane has been told by tech support/sysadmin that a server certificate can 
> >be installed for her on the Black server.
> >
> >What is the best solution? (easiest and most secure, security having 
> >priority)
> >
> >Is it sufficient to install kmMail on the secure server and simply point 
> >kmMail to the mail account on the other server?
> >Should kmMail be installed on the non-SSL server along with a server cert'?
> >Should kmMail be installed on the SSL server and a cert' be installed on 
> >the other one, then point kmMail that way?
> >Or is there some other solution?

I've gotta ask, what is your definition of 'use securely'?

For logging into accounts and retrieving email the account password should be
secured. With IMAP you can use CRAM-MD5 or DIGEST-MD5 passwords which will
prevent the password from being sent over the wire in clear text. If the
server doesn't support that then yes, SSL is the way to go.

Now I wouldn't bother to count on SSL for securing anything other than the
password when it comes to email. The entire end to end path an email takes
as it moves from the sender, to smtp servers, and finally to your inbox is
not secured. The email is passed over the wire and can be read at any point.

So what if you need end to end security for the contents of email? The
solution here is PGP which can handle both encryption of the email contents
as well as "trust relationships" which enable you to know that the sender is
really the person who sent the email.

I know this all doesn't answer your question directly but the point is you
may not need that SSL cert depending on what you expect to accomplish.

-- 
  Scott
  Do not trifle with me, I have eaten 104 brains.