Re: [pear-webmaster] Bug system, the password
| From: | Klaus Guenther | Date: | Fri, 23 Jul 2004 18:33:57 +0000 |
| Subject: | Re: [pear-webmaster] Bug system, the password | ||
| References: | 1 2 3 4 | Groups: | php.pear.webmaster |
| Request: | Send a blank email to pear-webmaster+get-2830@lists.php.net to get a copy of this message | ||
Martin Jansen <mj@php.net> wrote:
> On Fri Jul 23, 2004 at 10:5813AM +0200, Klaus Guenther wrote:
> > I'm kinda surprised that an OS
> > project saves passwords unprotected... :-/
>
> This is only true for bug reports; the passwords for PEAR accounts are
> not available in plaintext.
Yes, I was aware of that. However, I know of at least one dev who has openly
stated that he uses his dev account password for the bug reports. (Check the
archives.) It's still a security concern.
> > Esp. without motifying people of the fact.
>
> You won't believe how many websites save passwords that are far more
> critical than trouble ticket passwords in plaintext.
Yes, that is very true. I am guilty of that myself (mostly where it would
create a headache if a user would lose their password... and even then only
when primary authentication is handled by apache). However, it would be cool
to use MD5 here. :-)
Klaus