Steven F Siirila wrote: 
On Fri, Nov 03, 2006 at 10:36:13AM -0800, Marc Perkel wrote:
  
Jim Trigg wrote:
    
On Fri, November 3, 2006 12:09 pm, Marc Perkel wrote:
 
      
Gunter Ohrner wrote:
   
        
Am Donnerstag, 2. November 2006 23:43 schrieb Marc Perkel:

     
          
email. And the virus wouldn't have access to the IMAP password so
       
            
 
      
Why not?
     
          
 
      
Because the virus wouldn't have the password.
   
        
That doesn't answer the question.  Why would the IMAP password be any less
accessible to a virus than the SMTP password?  (For that matter, what you
just used was "proof by assertion" which is meaningless.  "The virus
wouldn't have access to the IMAP password because the virus wouldn't have
the password.")

Jim Trigg

 
      
IMAP requires a password. SMTP it's optional.
    

Not at the University of Minnesota.
We require ESMTP STARTTLS/AUTH over the standard mail submission port (587).
OK - but the rest of the world varies from what the University of Minnesota does.

  
I think that consumer SMTP 
should be replaced with not only something that requires a password, but 
that the user has to log into the account that they are sending email 
from.
    

Not necessary -- configure your mail server to match your policy requirements.
Yes but it's optional. I've done it that way but others don't.

  
SMTP doesn't have to be tied to IMAP accounts.
    

Correct.  In fact, you can have multiple IMAP accounts configured in an
e-mail client, but may have only 1 SMTP account set up (which doesn't even
have to match up with any of the IMAP accounts).  At least in Thunderbird.

But with outgoing IMAP you wouldn't have to configure outgoing email at all.
  
If you have an SMTP account you can spoof anyone.
    

That is an SMTP issue in general, not an authentication issue.
If you have Internet access at all, you can spoof anyone by simply
connecting to a remote port 25 and sending to your heart's content
without needing any passwords...

But you could limit a domain to require that the sending email come from the account of the receiving email.
  
My idea with IMAP sending is to deny the 
ability of the sender to use a different email address that the one that 
they are logged into. This is to prevent spam and spoofing.
    

You can certainly do this on your mail server, but you can't force every
other server on the Internet to do the same.  :)

But I think if we tightend up the spec some we could eliminate most spam.