Greg Hudson wrote:
>>No, the password is scrambled which is of course not secure, but it does
>>provide glance-over-shoulder "security".
>
> Essentially worthless, since there's no need to look at the client
> password file.
I have accidentally glanced another person's password in the client
password file. This was on an account that is shared among several
users to do builds for our company's products. Before the no-auth-cache
default had been set in ~/.subversion/config, several users (including
myself) had performed Subversion operations that cached their passwords.
When I realized this, I decided to delete the file containing my
cached password.
Why I didn't just delete them all, I don't know. Why I didn't grep for
my username, I don't know. Being somewhat slow in the head, I catted
the first file in the directory, which happened to be someone else's
cached credentials. Whoops! When I realized what I was looking at, I
immediately got it off my screen, but the first few characters of the
password etched themselves into my head. Fortunately, I've forgotten
them now. I also told the person what happened, so hopefully the
password is changed anyway.
That's the kind of situation that it might be nice to avoid by default,
even if just by trivially scrambling the password. Was it my fault for
looking at the password file? Yes. But in a moment of stupidity I did
it anyway. I would guess I'm not the only one who's had this kind of
experience (but I hope I am).
--
Michael W Thelen
It is a mistake to think you can solve any major problems just with
potatoes. -- Douglas Adams
Received on Tue Jan 4 15:52:51 2005