[jdev] plaintext passwords hack

[Dave Cridland]

On Fri Dec 18 15:41:39 2009, Peter Saint-Andre wrote:
> On 12/18/09 8:07 AM, Alexander Holler wrote:
> > Am 18.12.2009 14:58, schrieb Alexander Holler:
> >> Storing a hash for every mechanism will not work. E.g. for  
> DIGEST-MD5
> >> the server has to hash the clear-text password with a value the  
> client
> >> provides. So the server needs the clear-text password. And if  
> the server
> >> is able to get the clear-text password, everyone with the same  
> rights on
> >> the server can retrieve the clear-text passwords too.
> >
> > The solution to this problem are public key algorithms. So using
> > (enforcing) client-side SSL certificates would do the trick.
> >
> > Maybe a XEP which defines how a client sends his (public part of  
> the)
> > certificate during the registration process would be a practical  
> solution.
> 
> Yes, I've been thinking about that for a while, but I haven't had  
> time
> to write up a document about it. I think we might want to avoid  
> X.509
> (with its dependency on ASN.1 etc.) and instead use simple RSA keys  
> as
> in XEP-0189. But I'll give it more thought soon.

I agree that ASN.1 isn't terribly easy, but it's all just blobs,  
really - it strikes me as simpler to just reuse existing self-signed  
cert generation code for the purpose.

Plus, that gains you the ability to tap into sometmes quite advanced  
X.509 personal key stores on some operating systems.

Dave.
-- 
Dave Cridland - mailto:dave at cridland.net - xmpp:dwd at dave.cridland.net
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade