Re: Jabber broken in 1.0.1 & Fire CVS?

On 10 Jun, 2004, at 21:36, Evan Jones wrote:

>
> On Jun 10, 2004, at 3:59, Elektron wrote:
>> After warning you that digest authentication failed, of course (or a 
>> checkbox to use plaintext).
>
> So I can see this two ways:
>
> a) What does a user care about digest or plain text authentication? 
> They just want their instant messaging to work, and in this case, Fire 
> should just transparently retry with another authentication scheme.
> b) Someone *might* care that their password is being sent unprotected 
> over the Internet. Of course, if you are using SSL, this is not a 
> concern. Also, currently Fire makes no guarantees that it won't use 
> plain text authentication, so this point is somewhat moot.

(Encrypted) plaintext authentication is actually more secure than 
digest, in the respect that the server does not need to store the 
password.

>> There's probably some program to stuff a password into the database 
>> (such as htpasswd for Apache).
>
> Yes, there are alternatives. But the point here is that this server is 
> set up to use the Unix password, so that is what it has to work with. 
> In this case, it can only do plain text authentication.
>
> I think that there are really a couple of fixes to this problem:
>
> 1. Correct JabberD so that if it tries to use PAM, it only offers 
> plain text authentication.

The problem with this could be that Jabber (I suspect) declares what 
authentication methods it accepts before it receives a username, and 
some users may have a digest password set up, while others may not. But 
I don't run a Jabber server so I wouldn't know.

> 2. Add a note in the protocol about retrying with different 
> authentication mechanisms. I have to wonder: what do things like POP3 
> clients do when the server supports a bunch of mechanisms?

APOP is actually a very lame (read: simple) mechanism, whose only 
purpose is to prevent someone from grabbing the pass and then logging 
in as you, or deleting your mail. The POP server declares that it has 
APOP by adding <pid:[email protected]> to its welcome message; it's up to the 
mail client to decide whether to use it (in Mail, "Password" and "MD5 
Challenge-Response".

> Anyhow, I actually don't care enough about this issue to patch Fire, 
> so I'm afraid I'm going to let it slide.

I'm not even sure if it can be classified as a 'bug' (it depends on the 
behaviour of the official client). But then, I've never used Jabber.

- Purr



-------------------------------------------------------
This SF.Net email is sponsored by: GNOME Foundation
Hackers Unite!  GUADEC: The world's #1 Open Source Desktop Event.
GNOME Users and Developers European Conference, 28-30th June in Norway
http://2004/guadec.org
_______________________________________________
Fire-talk mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fire-talk
Have a question? Please read the Fire Frequently Asked Questions:
http://fire.sourceforge.net/faq.shtml