Quantcast
Channel: Ignite Realtime: Message List
Viewing all articles
Browse latest Browse all 12162

Re: Bug: Encrypted Passwords in Openfire's Database don't offer more security than Plaintext Passwords

$
0
0

Yes, seeing how often the question was asked in this forum, i do believe it could be of use, there are a few use cases i can think of when you don't want to go through a webUI, and i did not find any other way to go (and count me in the camp of "better have no security than an unfounded feel of security") ... but for decryption only i could have gone with the several similar implementation i found around the web (wierdly, mostly in php ... probably because of the availability of mcrypt in php).

 

Fixing this would not be code intensive, the main time sink being determining an implementation choice, because keeping backward compatibilty or having an automatic update would require either a new field "sha-1 password" in OFUSER (and modifying a database structure is never a happy process), either use the "encrypted password" field, but for that you would need an update script to convert the encrypted passwords into hashed passwords, and there would be no version rollback possible in that case. So no silver bullet here.

 

For the second option, the code (appart from the database conversion) might be already done (i did not check it but this seems sensible):

http://stackoverflow.com/questions/3409657/openfire-sha-1-passwords-without-blow fish-encryption

 

Cheers,


Viewing all articles
Browse latest Browse all 12162

Trending Articles