Re: RFC: Encrypting ~/.subversion/auth on Windows

Branko Èibej <brane@xbc.nu> writes:
> Er, pray tell, how is this different from storing cleartext passwords
> on the server, as we're doing now? If client and server both start
> with the same hash, it's as if the hash were the cleartext password.

The benefit is that if the hash gets compromised, at least the
person's real (plaintext) password isn't revealed -- so if they're
using that same password for other systems, then at least those
systems have not been compromised.

-Karl

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Mon Nov 15 19:22:46 2004