Re: Auth feature

Hi, Bertrand Mansion schrieb:

<mbretter@jawa.at> wrote :

I think both should possible, md5(id + challenge + md5(pass)) wich isn't RFC conform and md5(ip + challenge + pass).

I guess you meant id, not ip. sure, thanx,

I strongly recommend implementing also RFC 1994 conform CHAP, because otherwise the RADIUS Auth Container doesen't work.

IIRC, if someone gets the md5 encrypted password + the challenge and turns off javascript, he can login the same as if he had the non encrypted no, because he has also to catch the session.

The challenge is generated on the server, when the login page is opened, and then stored in the session. If the user submits the loginform then on the server a hash is generated using the challenge from the session and then compared to the hash sent from the browser. This means an attacker has also to take over the session.

Additionally, some users might not have enabled javascript which will lead to confusion when trying to compare the credentials against the auth container. there must be some optional fallback mechanism or a hint that the user must enable javascript.

Having only encrypted passwords in the container is nice but as md5 cannot be decrypted, if a user forgets its password, you will have to send him a new one (probably by unsecure mail). yep. so it is, I think this depend's on the application, we have in our system both options (md5 or just base64-encoded).

I have used this solution for some time and I don't think it's worth it. The only secure solution is SSL. And maybe enforce users to choose secure agree, if you wan't 99% security then you have to use SSL, but sometimes you can not or you don't want to use SSL.

passwords. I would see an interest though for an intermediate solution with encrypted password that could be decrypted (not md5). this should also be possible, because I'm having here implementation's of DES and 3DES in JavaScript.

I will provide soon a link to that what I'm having already, but It's "only" a prototype atm. bye, -- ------------------------------- ------------------------------------- Michael Bretterklieber - Michael.Bretterklieber@jawa.at JAWA Management Software GmbH - http://www.jawa.at Liebenauer Hauptstr. 200 -------------- privat --------------- A-8041 GRAZ GSM: ++43-(0)676-93 96 698 Tel: ++43-(0)316-403274-12 E-mail: michael@bretterklieber.com Fax: ++43-(0)316-403274-10 http://www.bretterklieber.com ------------------------------- ------------------------------------- "...the number of UNIX installations has grown to 10, with more expected..." - Dennis Ritchie and Ken Thompson, June 1972