Re: Plaintext passwords
"Norman Rasmussen" <[email protected]>
| Newsgroups | gmane.network.jabber.admin |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Oct 10, 2008 at 11:09 PM, Simon Friedberger <[email protected]<simon%[email protected]> > wrote: > a) The passwd approach: > Pro: The server does not store the passwords. > Con: The password has to be sent over the wire. > b) The CRAM-MD5 approach: > Pro: The password is not sent over the wire. > Con: The server has to store the password. > c) The DIGEST-MD5 approach: Pro: The password is not sent over the wire. The password can be stored as a salted hash (salt is user/realm) in the database (can't use rainbow tables to reverse hash). Con: If you decide that MD5 isn't cutting it, and you want to use SomeotherHashAlgorithm instead, then you need to ask the user for the plaintext password (or a new username/realm/password hash). -- - Norman Rasmussen - Email: [email protected] - Home page: http://norman.rasmussen.co.za/ _______________________________________________ JAdmin mailing list FAQ: http://www.jabber.org/discussion-lists/jadmin-faq Forum: http://www.jabberforum.org/forumdisplay.php?f=19 Info: http://mail.jabber.org/mailman/listinfo/jadmin Unsubscribe: [email protected] _______________________________________________