On Monday, March 12, 2007 06:09:23 PM +0100 Frank Ellermann <nobody@xxxxxxxxxxxxxxxxx> wrote:
Finally the second part says implementations won't bother to check the certificate, and then PLAIN isn't good enough. Now that's tricky, if it's true
Sadly, it is. All too many TLS-using applications, especially email clients, either completely ignore certificate validation or treat all self-signed certificates as trust anchors. So, mechanisms which do not reveal the user's password to the "server" are highly desirable.
-- Jeff