Re: Plaintext passwords
"anders conbere" <[email protected]>
| Newsgroups | gmane.network.jabber.admin |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Oct 10, 2008 at 2:08 AM, Norman Rasmussen <[email protected]> wrote: > On Fri, Oct 10, 2008 at 10:56 AM, Simon Friedberger > <[email protected]> wrote: >> >> I was wondering why ejabberd only allows saving passwords in plaintext. >> If this has been already discussed I'm sorry to bring it up again. >> Somebody in the ejabberd muc pointed me at their FAQ but it didn't >> give any real reasons so maybe somebody could point me in the right >> direction. > > Because it makes it simpler and easier to make it possible to confirm that > the client knows the same password without having send it over the wire when > authenticating, (or encrypt it before sending). > Another reason is that it doesn't matter how the password is encrypted, if > the jabber server binary can read it, then so can the server admin. > The only non-plaintext storage that makes any sense, is probably digest-md5. > Although then the only way to 'upgrade' a password from say md5 to sha1, if > for the client to provide a plaintext password - which is what we're trying > to avoid. > > With the proposed requirement of TLS encryption when connecting to a server, > the plaintext requirement is only slightly relaxed -- you end up trusting > the TLS layer to protect your password from attack. Which the rest of the world has agreed is a much safer assertion then trusting server admins to keep the passwords safe. (see reddit for example of leaking passwords). Frankly it's just a bad idea to store the passwords in plain-text and the sooner that gets fixed not only in the spec but as an understanding within the community the better. ~ Anders > -- > - Norman Rasmussen > - Email: [email protected] > - Home page: http://norman.rasmussen.co.za/ > > _______________________________________________ > JAdmin mailing list > FAQ: http://www.jabber.org/discussion-lists/jadmin-faq > Forum: http://www.jabberforum.org/forumdisplay.php?f=19 > Info: http://mail.jabber.org/mailman/listinfo/jadmin > Unsubscribe: [email protected] > _______________________________________________ > > _______________________________________________ JAdmin mailing list FAQ: http://www.jabber.org/discussion-lists/jadmin-faq Forum: http://www.jabberforum.org/forumdisplay.php?f=19 Info: http://mail.jabber.org/mailman/listinfo/jadmin Unsubscribe: [email protected] _______________________________________________