Re: CHAP login

On Sat, 1 Oct 2005 16:02:40 +0200 mj@php.net (Martin Jansen) wrote: > As already mentioned in another thread, I've started working on > making the login to the website more secure by using a CHAP system. > The concept is rather simple: > > The client sends the MD5 hash of the user's password with a challenge > string appended to it. The server can then recalculate and compare > the "challenged" password with the password from the database plus > the challenge string, all without the password being transmitted in > clear text. Even after I told you to do not waste your time with that, well you wrote it. The patch is short, I will review and test tomorrow evening (meaning do not commit it before). A quick comment, _test_ variables instead of using @, and _filter_ them. But you know that, do you? > I've attached a patch for this. Comments appreciated. > > In order to kick the CHAP login off, we'll need to update a handful of > accounts that are still using DES-style passwords. The owners of the > accounts are already informed, and I hope to get a response from them > shortly. Ignore them, they will complain if they come back. > Once this is done, I'd also like to get rid of support for > DES-passwords in the code, because virtually nobody is using them. Virtually they can, practically they do not. I do not see a problem to remove DES support. Regards, --Pierre