Re: Plaintext passwords

> > Or you could just write them a message saying "For security purposes
> > please enter your password again." and have the new hash computed by the
> > client and sent to the server which in turn may store it. (Though that's
> > just something I came up with right now so it may be inherently flawed.)
> >
> 
> If the server (you checked it was the server's jid right?) sent you an im
> with a link to a web-page with this type of request, would you do it?  How
> would you check that the page's url was valid?  If I told you you had to
> download a special program to do it, would you do it?

Actually I was thinking about this in simpler terms and just expected
the client to support password change using the secure connection that
was established using the old password.


I am very interested in your suggestion:
> you can store:
> 
> H( { username-value, ":", realm-value, ":", passwd }
> 
> that way the password is not in plain text, and the stored value can
> be used for DIGEST-MD5 authentication, so there's never a plaintext
> password transferred on the wire.
Did you follow that thought further?
I think the fact that users use password schemes is one of the main
points of the entire discussion. If server and client were simply to use
a hash of the password as shared secret this could be solved, right?
_______________________________________________
JAdmin mailing list
FAQ: http://www.jabber.org/discussion-lists/jadmin-faq
Forum: http://www.jabberforum.org/forumdisplay.php?f=19
Info: http://mail.jabber.org/mailman/listinfo/jadmin
Unsubscribe: [email protected]
_______________________________________________