>> 3. ugh. Hadn't realized that. I like IMAP even less, now. (Told you I didn't know much about MIME ;-)
>> 6. I wasn't intending it as a security mechanism, but as a way to know which bits you have and which you don't. Do you think SHA-1 is still a bad idea in that case?
I like IMAP even less, now. (Told you I didn't know much about MIME ;-)
IMAP might do some sort of MIME-handling, but MIME is part of the email spec, not the IMAP spec. Hating IMAP because of MIME is like hating cars because of the invention of the wheel (i.e. thinking that the wheel was invented as part of the production of the initial automobile).
Multipurpose Internet Mail Extensions (MIME) is an
Internet standard that extends the format of e-mail
to support:
* Text in character sets other than ASCII
* Non-text attachments
* Message bodies with multiple parts
* Header information in non-ASCII character sets
MIME is used to say things like 'this block of text is a base64-encoded file attachment, but also to say 'this block of text is encoded with this charset.'
If you use Gmail, try the 'open original message' option on emails that have attachments or multiple text parts on them (or even emails that have both a text and an html version of the content).
Dealing with MIME is part of dealing with emails in general, regardless of if you're interacting with an IMAP server, or composing an email to send to another user on the same mainframe (i.e. just moving files around).
That is a security mechanism. If I can inject a message with a hash that collides with something else in your queue, I can at least prevent you from seeing the original, or potentially spoof a message from someone else.
I know it depends on knowing hashes of other messages in the mailbox, but if the hashes are supposed to persist, that might not be a problem.
Duplicate suppression can be tricky. The overhead may not be worth the benefit, and the risk of message corruption is increased. Besides, if the mail is encrypted by the user, it may not even be feasible to do server-side.
>> 6. I wasn't intending it as a security mechanism, but as a way to know which bits you have and which you don't. Do you think SHA-1 is still a bad idea in that case?