views:

352

answers:

1

Why do I need to encode login and password in base64, when using SMTP-AUTH. Here is an example of my SMTP conversation

220 ALAN.CP.com Microsoft ESMTP MAIL Service 
ehlo 
250 ALAN.CP.com Hello [10.10.1.1] more... 
verbs 
250 OK 
auth login 
334 VXNlcm5hbWU6 
<base64 encoded password>
334 UGFzc3dvcmQ6 
<base64 encoded password>
235 2.7.0 Authentication successful.
+1  A: 

Basic SMTP doesn't require auth at all. SMTP-AUTH is defined in RFC 4954 but it doesn't define the specific type of auth you're using here 'auth login'. It does say.

A server implementation MUST implement a configuration in which it does NOT permit any plaintext password mechanisms

I can't find a specification for 'AUTH LOGIN', though googling it indicates its most likely a Microsoft exchange only feature. Further googling indicates your example is directly copied from here.

If you're asking why the particular example is base64 encoded, its because Microsoft has a dumb interpretation of the RFC's prohibition on cleartext. If you want to know why other SMTP auth mechanisms use base64, its because typically the data they're sending is actually binary data of some sort (like a MD5 hash of the shared secret and a token provided by the server). If this doesn't answer your question, please edit your question to include more details.

Jherico
You've accidentally posted your username and password in a public forum. I've flagged your comment for removal.
Jherico
Ah, nm, I see this is actually not your auth information, but from some random website.
Jherico
> A server implementation MUST implement a configuration in which it does NOT permit any plaintext password mechanismsthank you very much!
bridgahad
no problem. Maybe you can hit 'accept' on my answer.
Jherico