Re: passwords in subversion

Ben Collins-Sussman wrote:
> 
> Rainer:  the problem is cryptograhpically tricky.  If the server stores 
> hashed passwords (like those in htpasswd, or in /etc/passwd), then 
> cleartext passwords must pass over the network.  If the server stores 
> cleartext passwords, then hashes may pass over the network.

   Actually, you can have the best of both worlds.

   Server stores HASH(pw)

   Client generates random token, and calculates this:

     authstring = HASH(HASH(pw)+token)

   Client sends "authstring,token" to server.  Server can recalculate
   authstring to verify that the client knew "pw" (or at least,
   HASH(pw)).  Neither "pw", nor "HASH(pw)" are ever sent over the
   wire.

   If someone can get copies of the hash, then you're still screwed
   (the hash is basically the password), but hopefully, hashes are harder
   for people to remember by looking over your shoulder.

   (Is this how HTTP Digest authentication works?  I should go read the
    RFC...)

daniel