Re: svnserve password store in clear text

Mark Benedetto King wrote:
> On Fri, Jun 04, 2004 at 12:15:42AM +0200, Branko ??ibej wrote:
>
>>Mark Benedetto King wrote:
>>

>>>They enter that hash rather than their plaintext password the one time
>>>that svn asks them for it, and voila, everything works.
>>>
>>>As an added benefit, they can use whatever hash function they want!
>>>
>>>
>>
>>That doesn't mean a thing, you know. Anyone who can read the "hashed"
>>password can still spoof the user id -- since it's not actually hashed,
>>it's just a weird-looking plain text password.
>
>
> Exactly! And anyone reading a base64-obfuscated password can go
> base64-deobfuscate it, too.
>
> It's difficult for the client to prove it knows a secret that the
> server cannot be trusted to know without a PKI of some sort.

and yet there are protocols which accomplish it, such as SRP:

http://www.ietf.org/rfc/rfc2945.txt
http://srp.stanford.edu/

The server stores only a verifier, and doesn't need to know the plain
text password for the client to authenticate.

John

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Fri Jun 4 01:04:25 2004