From: "Geo" 

"Tony Williams"  wrote in message
news:4358073c$1{at}w3.nls.net...


> What about RFC 2047? That appears to allow 7-bit encoding of unicode
> subjects.

Thanks, I'm astounded that the people writing these RFC's have no concept
of security requirements. Read this quote from that RFC:

A mail reader need not attempt to display the text associated with an
   'encoded-word' that is incorrectly formed.  However, a mail reader
   MUST NOT prevent the display or handling of a message because an
   'encoded-word' is incorrectly formed.


What were they smoking? I can just picture these people writing a password
specification "the password checking routine must not fail because a
password is incorrectly formed"...

No wonder Outlook Express and IE are such huge security problems, I always
thought it was MS's fault but it's not,  the specifications require them to
be insecure.

Geo.

--- BBBS/NT v4.01 Flag-5