[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: svnserve password store in clear text

From: John Pybus <john.pybus_at_zoology.oxford.ac.uk>
Date: 2004-06-04 01:01:54 CEST

Mark Benedetto King wrote:
> On Fri, Jun 04, 2004 at 12:15:42AM +0200, Branko ??ibej wrote:
>
>>Mark Benedetto King wrote:
>>

>>>They enter that hash rather than their plaintext password the one time
>>>that svn asks them for it, and voila, everything works.
>>>
>>>As an added benefit, they can use whatever hash function they want!
>>>
>>>
>>
>>That doesn't mean a thing, you know. Anyone who can read the "hashed"
>>password can still spoof the user id -- since it's not actually hashed,
>>it's just a weird-looking plain text password.
>
>
> Exactly! And anyone reading a base64-obfuscated password can go
> base64-deobfuscate it, too.
>
> It's difficult for the client to prove it knows a secret that the
> server cannot be trusted to know without a PKI of some sort.

and yet there are protocols which accomplish it, such as SRP:

http://www.ietf.org/rfc/rfc2945.txt
http://srp.stanford.edu/

The server stores only a verifier, and doesn't need to know the plain
text password for the client to authenticate.

John

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Fri Jun 4 01:04:25 2004

This is an archived mail posted to the Subversion Dev mailing list.