Mark Benedetto King <mbk@lowlatency.com> wrote on 06/03/2004 10:47:44 AM:
> On Thu, Jun 03, 2004 at 12:02:32PM +0800, Ng, Wey Han wrote:
> >
> > I have a proposal. Here goes:
> >
> > In the libsvn_ra_svn library the compute_digest (in cram.c) function
the
>
> Your suggestion boils down to "have svn treat the secret as if it were
> really MD5(secret)".
>
> If the problem you're trying to solve is one of people not liking their
> favorite plaintext passwords to exist in files on the svn server, why
> not just have them generate hashes of their plaintext passwords and
> send you those? You can put those in the password file (or write a
> CGI program to do it).
>
> They enter that hash rather than their plaintext password the one time
> that svn asks them for it, and voila, everything works.
>
> As an added benefit, they can use whatever hash function they want!
>
Excellent point! Also, since Subversion can cache the credentials, it
isn't like the user has to enter the hash again and again. I still think
people with these requirements should look more closely at Apache, but
this is a simple and practical solution to the problem that does not
pollute the svnserve implementation.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Thu Jun 3 17:34:18 2004