Re: [pear-webmaster] CHAP login

Hello Martin, From Saturday, October 1, 2005, 4:02:40 PM, you wrote: MJ> As already mentioned in another thread, I've started working on making the MJ> login to the website more secure by using a CHAP system. The concept is MJ> rather simple: MJ> The client sends the MD5 hash of the user's password with a challenge string MJ> appended to it. The server can then recalculate and compare the MJ> "challenged" password with the password from the database plus the challenge MJ> string, all without the password being transmitted in clear text. Hmm. What challenge is for? I thought server must issue challenge string - not client - or else it will be the same thing as with plain MD5. Code seems ok with that. MD5 is easily bruted up to 8 symbols, so it is better to use another method. But even in this case MITM can strip JS code to make client switch to plain auth. Although it requires some expertise if one concerned he/she can easily get the pass. The only somehow secure solution is to get root-signed SSL certificate, setup Apache, shell server accordingly and learn developers how to use CVS through SSH. MJ> I've attached a patch for this. Comments appreciated. MJ> In order to kick the CHAP login off, we'll need to update a handful of MJ> accounts that are still using DES-style passwords. The owners of the MJ> accounts are already informed, and I hope to get a response from them MJ> shortly. DES? =) He-he, you can setup a script which will do the job automatically at a rate of approximately one user/day if you'll find a living code for it though. =/ John the Ripper might have this proc. MJ> Once this is done, I'd also like to get rid of support for DES-passwords in MJ> the code, because virtually nobody is using them. MJ> - Martin -- anatoly