[sldev] [POLICY] Development by consensus (Re: Question regarding upcoming maintenance on 11/27-

[Tateru Nino]

Callum Lerwick wrote:
> On Tue, 2007-11-27 at 19:46 +0000, Matthew Dowd wrote:
>   
>> This claim is constantly made with no justification. The only know
>> phishing attempt involving the grid was when someone managed to craft
>> a URL to cause the client to logon to a third party server. The
>> correct solution to that would be to use MD5 Challenge Response so
>> that the password is never sent to the authenticating server
>> (worringly in Sabin's summary of the meeting, he completely missed the
>> raison d'etre behind MD5 challenge response).
>>     
>
> You keep making THIS claim, which seems to be bullshit. As I discovered
> with the Fedora 8 curl bug, packet sniffing confirms the client DOES
> authenticate over SSL. And it better be properly checking the server
> certificate. If so, the client will NOT send your password to a non-LL
> server.
>
> And as I've pointed out, challenge-response is NOT the most secure
> solution. It requires the server to have long term knowledge of your
> password, which leaves you vulnerable to the back end authentication
> server being hacked. Which HAS happened.
>
> Forget challenge-response. SSL is the way to go, and it is already in
> use.
>   
I'm not convinced that there's a certificate check taking place. There
_might_ be, but that's one aspect I'm not certain about.

-- 
Tateru Nino
http://dwellonit.blogspot.com/