Re: [pear-webmaster] Bug system, the password
| From: | Helgi Þormar | Date: | Fri, 23 Jul 2004 19:41:50 +0000 |
| Subject: | Re: [pear-webmaster] Bug system, the password | ||
| References: | 1 2 3 4 5 | Groups: | php.pear.webmaster |
| Request: | Send a blank email to pear-webmaster+get-2832@lists.php.net to get a copy of this message | ||
On Fri, 2004-07-23 at 18:33, Klaus Guenther wrote:
> Martin Jansen <mj@php.net> wrote:
>
> > On Fri Jul 23, 2004 at 10:5813AM +0200, Klaus Guenther wrote:
> > > I'm kinda surprised that an OS
> > > project saves passwords unprotected... :-/
> >
> > This is only true for bug reports; the passwords for PEAR accounts are
> > not available in plaintext.
>
> Yes, I was aware of that. However, I know of at least one dev who has openly
> stated that he uses his dev account password for the bug reports. (Check the
> archives.) It's still a security concern.
>
> > > Esp. without motifying people of the fact.
> >
> > You won't believe how many websites save passwords that are far more
> > critical than trouble ticket passwords in plaintext.
>
> Yes, that is very true. I am guilty of that myself (mostly where it would
> create a headache if a user would lose their password... and even then only
> when primary authentication is handled by apache). However, it would be cool
> to use MD5 here. :-)
>
So Martin could you boost the passwd field up to 32 varchar ? :)
Then at least we have can maybe later on (or maybe soon ;)) support MD5
:)