4 ms·

My bad, I forgot to include that I meant a bug that leaks the password. Basically my problem is with having one password for everything. Set up a package index

by underyx 10y ago

My bad, I forgot to include that I meant a bug that leaks the password. Basically my problem is with having one password for everything. Set up a package index with LDAP auth, and people will just carelessly save their credentials in plain text so that `pip` or whatever can pick it up.

dozzie 10y ago
First, you seem not to understand how LDAP authentication works. It's not reading plain text passwords to compare against what user provided. It's not even reading a hash and comparing user-provided password with that. It's sending password to LDAP server to ask if it is valid for specified user. Then, don't underestimate the alternative: a selection of sticky notes with passwords for each service slapped on monitor, which is still a valid concern in business setting. And with LDAP you at least have one place to invalidate credentials and to enforce minimum password complexity (to avoid "password123" passwords).
- underyx 10y ago
  A scenario for leaking passwords would be (from a comment of mine below): >Someone naively sets up error reporting that takes the POST data and logs it somewhere. Employees can now see the passwords from POST data and impersonate each other, or in an even worse case, a vulnerability with the error reporting software can leak the passwords to the public. I guess the second point is fair.
  - dozzie 10y ago
    You don't have any way of defending against that stupid scenario, with or without centralized passwords. Additionally, most of the users would probably use the same password for each of the services anyway, so you have pretty much the same situation in both cases, only you don't have a quick and reliable way to invalidate all the passwords.
fiedzia 10y ago
> Basically my problem is with having one password for everything. LDAP does not mandate single password. You are absolutely free to use something that will generate one-time passwords and send them via LDAP.
- underyx 10y ago
  Ah, now that, I did not know about. Do you have any specific examples?
  - fiedzia 10y ago
    I haven't used it, but first result in google is this for OpenLDAP: http://www.phoronix.com/scan.php?page=news_item&px=openldap-totp-support http://www.phoronix.com/scan.php?page=news_item&px=openldap-... . What I really meant was that you have user who types password, an app that uses LDAP protocol to send password and LDAP server which verfies it. You can easily password generator (as many banks do) without changing LDAP protocol.

by underyx 10y ago

dozzie 10y ago

First, you seem not to understand how LDAP authentication works. It's not reading plain text passwords to compare against what user provided. It's not even reading a hash and comparing user-provided password with that. It's sending password to LDAP server to ask if it is valid for specified user. Then, don't underestimate the alternative: a selection of sticky notes with passwords for each service slapped on monitor, which is still a valid concern in business setting. And with LDAP you at least have one place to invalidate credentials and to enforce minimum password complexity (to avoid "password123" passwords).

underyx 10y ago
A scenario for leaking passwords would be (from a comment of mine below): >Someone naively sets up error reporting that takes the POST data and logs it somewhere. Employees can now see the passwords from POST data and impersonate each other, or in an even worse case, a vulnerability with the error reporting software can leak the passwords to the public. I guess the second point is fair.
- dozzie 10y ago
  You don't have any way of defending against that stupid scenario, with or without centralized passwords. Additionally, most of the users would probably use the same password for each of the services anyway, so you have pretty much the same situation in both cases, only you don't have a quick and reliable way to invalidate all the passwords.

fiedzia 10y ago

> Basically my problem is with having one password for everything. LDAP does not mandate single password. You are absolutely free to use something that will generate one-time passwords and send them via LDAP.

underyx 10y ago
Ah, now that, I did not know about. Do you have any specific examples?
- fiedzia 10y ago
  I haven't used it, but first result in google is this for OpenLDAP: http://www.phoronix.com/scan.php?page=news_item&px=openldap-totp-support http://www.phoronix.com/scan.php?page=news_item&px=openldap-... . What I really meant was that you have user who types password, an app that uses LDAP protocol to send password and LDAP server which verfies it. You can easily password generator (as many banks do) without changing LDAP protocol.