Re: Jabber broken in 1.0.1 & Fire CVS?
Evan Jones <[email protected]>
| Newsgroups | gmane.network.fire.general |
|---|---|
| Message-ID | <[email protected]> |
On Jun 10, 2004, at 3:59, Elektron wrote: > After warning you that digest authentication failed, of course (or a > checkbox to use plaintext). So I can see this two ways: a) What does a user care about digest or plain text authentication? They just want their instant messaging to work, and in this case, Fire should just transparently retry with another authentication scheme. b) Someone *might* care that their password is being sent unprotected over the Internet. Of course, if you are using SSL, this is not a concern. Also, currently Fire makes no guarantees that it won't use plain text authentication, so this point is somewhat moot. > Of course, it's probably incorrect to say that the server is "broken". I think it is broken, because the server is advertising that it supports digest authentication by sending the SID string, but if you try to use digest authentication, it will fail. If the server didn't do that, then Fire would be able to log in. See my web log posting at: http://evanjones.ca/jabberd-pam-auth.html But of course, I have to wonder, how often will someone run into an incorrectly configured server? Hopefully never... > There's probably some program to stuff a password into the database > (such as htpasswd for Apache). Yes, there are alternatives. But the point here is that this server is set up to use the Unix password, so that is what it has to work with. In this case, it can only do plain text authentication. I think that there are really a couple of fixes to this problem: 1. Correct JabberD so that if it tries to use PAM, it only offers plain text authentication. 2. Add a note in the protocol about retrying with different authentication mechanisms. I have to wonder: what do things like POP3 clients do when the server supports a bunch of mechanisms? Anyhow, I actually don't care enough about this issue to patch Fire, so I'm afraid I'm going to let it slide. Evan -- Evan Jones: http://evanjones.ca/ "Computers are useless. They can only give answers" - Pablo Picasso ------------------------------------------------------- This SF.Net email is sponsored by: GNOME Foundation Hackers Unite! GUADEC: The world's #1 Open Source Desktop Event. GNOME Users and Developers European Conference, 28-30th June in Norway http://2004/guadec.org _______________________________________________ Fire-talk mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fire-talk Have a question? Please read the Fire Frequently Asked Questions: http://fire.sourceforge.net/faq.shtml