Re: SSO & HTTPS on pear.php.net

> > For more security i would suggest to remove the password (even if it's > > hashed) from the PEARWeb cookie and invent something like a ticket > > system > > for that (ticket is generated while logon and renewed everytime you get > > back). This would also be feasible for the RPC stuff. > Would it work with existing versions of PEAR Auth? Implementation will > be important. Current implementation of Auth_PEAR uses an XMLRPC call to get all userinfo, including the md5sum off the password. The only more secure way to do things would be to have an XMLRPC call that asks if User X and password Y match. As such, Auth_PAER would have to be updated to use this new call, if it is to be implemented. Current Auth_PEAR wouldn't work anymore anyway, once Martin removes the md5(passwd) from the userinfo returned. Cipri