Re: Authentication and email

["Steven M. Bellovin" <smb@research.att.com>]

In message <p0521031fba6dd7e4584a@[63.202.92.156]>, Paul Hoffman / VPNC writes:
>
>>   The IESG has already
>>stated that optional security is bad (because optional security means
>>no security).  Let's not revisit that rathole.
>
>We fully disagree here. Forcing visible security where none is needed 
>leads to most people not wanting to use security. If security is free 
>or very low-cost, it should be required. When it is any more 
>expensive either in processing time or in user hassle, it should be 
>optional and easy to implement if used.

More precisely, the IESG has stated that implementing interoperable
strong security is mandatory.  It has to be mandatory to implement
or it won't be interoperable.  As for low cost and/or invisible -- if
we can, we of course want that, but it's not always possible.