[sldev] [POLICY] Development by consensus (Re: Question regarding upcoming maintenance on 11/27-

[Callum Lerwick]

On Tue, 2007-11-27 at 19:46 +0000, Matthew Dowd wrote:
> This claim is constantly made with no justification. The only know
> phishing attempt involving the grid was when someone managed to craft
> a URL to cause the client to logon to a third party server. The
> correct solution to that would be to use MD5 Challenge Response so
> that the password is never sent to the authenticating server
> (worringly in Sabin's summary of the meeting, he completely missed the
> raison d'etre behind MD5 challenge response).

You keep making THIS claim, which seems to be bullshit. As I discovered
with the Fedora 8 curl bug, packet sniffing confirms the client DOES
authenticate over SSL. And it better be properly checking the server
certificate. If so, the client will NOT send your password to a non-LL
server.

And as I've pointed out, challenge-response is NOT the most secure
solution. It requires the server to have long term knowledge of your
password, which leaves you vulnerable to the back end authentication
server being hacked. Which HAS happened.

Forget challenge-response. SSL is the way to go, and it is already in
use.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.secondlife.com/pipermail/sldev/attachments/20071128/deeb9e9b/attachment-0001.pgp