Re: [9fans] pop3 before smtp

[Lyndon Nerenberg <lyndon@orthanc.ab.ca>]

On Thursday, July 10, 2003, at 02:01  PM, boyd, rounin wrote:

>>  From a practical standpoint, you don't need one.
>
> you do.  alice doesn't trust bob and bob doesn't trust alice.

You can put an SSL cert on the server if you really want to verify it's
who it claims to be. (Most people don't seem to care.) You don't need
one for the client, though, as you're verifying it via SASL. (And some
SASL mechanisms can also verify the server side while authenticating
the client, as well as performing encryption of the session. You pick
the one that matches your requirements.)

Again, I'm speaking from a *practical* standpoint, and addressing a
*very* narrow problem space. I, too, would like to see a global PKI
that actually works.

--lyndon