Re: Plaintext passwords
"Norman Rasmussen" <[email protected]>
| Newsgroups | gmane.network.jabber.admin |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Oct 11, 2008 at 1:32 AM, Simon Friedberger <[email protected]<simon%[email protected]> > wrote: > > c) The DIGEST-MD5 approach: > > Pro: The password is not sent over the wire. The password can be > > stored as a salted hash (salt is user/realm) in the database (can't use > > rainbow tables to reverse hash). > > Con: If you decide that MD5 isn't cutting it, and you want to use > > SomeotherHashAlgorithm instead, then you need to ask the user for the > > plaintext password (or a new username/realm/password hash). > > While I do like this approach you don't seem to be such a big fan > yourself or am I mistaken? > actually except for the "I want to change my password, safely" problem, I think this is the most technically superior solution. > Also, maybe Peter can tell us more about the abandonment by the IETF. > > Apart from that I still think that my point why the admin should be > allowed to chose from a) and b) is still valid. Any opinions on that? My personal server uses pam for authentication, so users _have_ to use plaintext authentication via TLS, and if they want to change their passwords, they have to use passwd via ssh. It's pretty secure, but hard to scale for services like jabber.org. This also means there are no passwords in the jabber database (hashed or otherwise), also pam will scale out to kerberos, or anything else that plugs into pam. -- - Norman Rasmussen - Email: [email protected] - Home page: http://norman.rasmussen.co.za/ _______________________________________________ JAdmin mailing list FAQ: http://www.jabber.org/discussion-lists/jadmin-faq Forum: http://www.jabberforum.org/forumdisplay.php?f=19 Info: http://mail.jabber.org/mailman/listinfo/jadmin Unsubscribe: [email protected] _______________________________________________