RE: Authentication

> On Wed, 5 Sep 2001, Sander Striker wrote:
> > In case of the stolen laptop you are still in a 'something you know'
> > only scenario since svn caches the auth information (username/pass)
> > in the working copy.
>
> That should be made configurable, then. The whole "~/.cvspass" paradigm
> is just a recipe for security failure. Much better is a persistant
> password daemon a la ssh-agent. GUI clients will keep it in memory, as
> well.
>
> Brian

Well, that brings me to say that it is configurable to have a pass phrase
on your private key accompagnying your cert. That way you always have
the 'something you have and something you know' situation.

I agree that password caching should be configurable for svn. In case
we just have single phase auth in the form of user/pass.

My point is that two phase auth in the form of cert - user/pass is not
more secure than cert only. It's the users config to worry about.

Sander

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Sat Oct 21 14:36:40 2006