Developers of Sympa

["Nicolas Brouard" <address@concealed>]

I got Serge Aumont on the phone and we agreed with the actual problem of
sympa. I also better understand his position even if I am not well aware of
the last cipher algorithms as he is.

To resume, he considers that there is a security hole when someone clicks on
a form to send a new password; because the cgi-bin line can be snooped (or
sniffed?) and written in the httpd log or elsewhere. This is a general
security problem. At least well known. Https solves this but is more
difficult to implement.

His actual reversible encryption proposition is to send back to the
subscriber, by mail, his or her original password. I am confident that the
manager will not add some code to log the password (so the problem is not
there). But I wonder if receiving a permanent password by mail is a good
solution. I am used to receive temporary passwords by mail and to change
them right away. Mails are stored on different places, more or less secure,
and I don't want that my usual password will be on any mail. So I will not
trust sympa and will enter a ridiculous password that I will forget very
soon, etc.
If I know that my password will be encrypted and can't be reverse, I will
trust sympa more.

Isn't it true?

Nicolas


-----Message d'origine-----
De : address@concealed [mailto:address@concealed]
Envoyé : vendredi 2 février 2001 15:59
À : address@concealed
Objet : Re: [sympa-dev] Encrypted password


Nicolas Brouard wrote:
>
> Do you mean that with a reversible encryption asap the list-manager cannot
> use it for his own profit?
He ! Asap c'est "as soon as possible", c'est pas un nouveau cipher !
>
> Log files of passwords are not very fair and must be avoided.
Ce que je veux dire c'est que dans la mesure ou le cryptage ne sera pas fait
par le client pour permettre un servioce de rappel, n'importe quel
programmeur
perl peut rajouter un log (qui bien entendu ne sera pas proposé en
standard).

Contre une modif du code de sympa, pas de solution. Il faut faire confiance
au
list manager ou le licencier !

Le cryptage (optionel) est presque terminé basé sur rc4 (CipherSaber).
Reste a tester.

>                                     Most of the security problems
>come from internal managers not from external hackers

Etrange affirmation !

Serge Aumont
--
-----------------------------------------------------------
Serge Aumont        Comité Réseaux des Universités
                     Campus Beaulieu
                     35042 Rennes Cedex   +33 2 998 471 47