Randy Bush wrote:

boys and girls, some folk with clue are trying to advise you to do something trivial that might raise the safety level a little. also, they may not want to describe why to blatantly.

Since this has been brought up... We've recently brought up a connection at AADS in July. Of about 30 peers brought online so far, this is a summary of the responses we've received when we've asked to implement MD5 authentication. Two refused. One simply said they don't support. The other with reasoning that it was dumb and unnecessary with point-to-point links (ATM PVCs). We had one peer who agreed to use it, but said it was really unnecessary. Another agreed to use it, but doesn't like to because they've found that their peers sometimes forget or lose the passwords. Guess who lost the password once already? :-) More than a half dozen organizations were doing authentication for the first time with us. Two organization said they don't support TCP MD5 authentication, but they'll do BGP password. Now when I ask I put a 'aka BGP password' in parentheses after I use the words 'TCP MD5 authentication'. Only one organization told me they *prefer* (my emphasis) to do authentication. The remaining organizations only do authentication if asked.

From the peering policies or online documentation I saw only one organization even mentioned authentication.

The most common means of exchanging a password was over the phone. Second most common way was via PGP encrypted email. One organization sent a password in plain text email. John