Re: Fwd: "POP3 SASL Authentication Mechanism" submitted for publication

[Arnt Gulbrandsen <arnt@xxxxxxxx>]

Alexey Melnikov writes:
> Simon Josefsson wrote:
> > and TLS+CRAM-MD5
>
> This doesn't give anything over TLS+PLAIN and also doesn't support 
> authorization identity.
> I am against this choice.

TLS+CRAM-MD5 doesn't reveal the user's secret to the server. A very nice 
property if you're not 100% sure that you're talking to the right 
server.

Arnt