Thanks AC. Glad to see you went to the comedy school of IT.
"I manage the people who run the email servers for my company. I have a degree in business; I am skilled at synergizing my big-picture ideas on a going-forward basis."
No business degree, sorry. Just an engineer and I manage nobody, I design and build the systems. i'm glad that you think I'm qualified to run the whole show, I'll make sure to remember that at my next review.
"We need secure logins, but we don't trust our users."
Well no I don't trust my users, and neither does any other systems admin but that's not the point. Building a secure and usable access control mechanism for mobile devices is hard. Would you be happy if you hired a systems admin who accepted that a username and password alone was sufficient for remote access into your systems? If so then its time you reviewed your risk posture - for my part I like to use RSA-Keys, Certs and one time tokens for that sort of thing. Passwords do not cut it, sorry.
"We did not cover secure IMAP in my MIS classes."
Actually true but only because I never attended any MIS classes. Anyway I was talking about authentication protocols and not mail protocols here so I don't see your point. Mutually authenticated secure IMAP would be good if it turns out to be possible to figure out a secure way to distribute certificates to the device but there is no indication that the iPhone will ship with a good enough certificate enroller and as a closed system writing our own is not an option.
"Encrypted, password-based authentication is too simple to possibly guarantee my job."
100% true. I'd be fired if I suggested it and I'd expect no less. Seriously, passwords don't cut it for authentication over untrusted links in this day and age, if you haven't realized that yet then I suggest you start thinking about why good SSH implementations don't use them.
Annalee Newitz questions whether it's a good idea to store your life on someone else's servers: Data crash of 2027: "... this situation is worse than potentially being data-raped by some feds trolling for terrorists. When we store all our personal, financial, and social information on other people's computers, we risk losing everything for reasons even s
Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (9) Dammit, little-endian systems *are* more consistent!