2 ms·
First, you seem not to understand how LDAP authentication works. It's not reading plain text passwords to compare against what user provided. It's not even read
by dozzie 10y ago
First, you seem not to understand how LDAP authentication works. It's not
reading plain text passwords to compare against what user provided. It's not
even reading a hash and comparing user-provided password with that. It's
sending password to LDAP server to ask if it is valid for specified user.
Then, don't underestimate the alternative: a selection of sticky notes with
passwords for each service slapped on monitor, which is still a valid concern
in business setting. And with LDAP you at least have one place to invalidate
credentials and to enforce minimum password complexity (to avoid "password123"
passwords).
- underyx 10y agoA scenario for leaking passwords would be (from a comment of mine below): >Someone naively sets up error reporting that takes the POST data and logs it somewhere. Employees can now see the passwords from POST data and impersonate each other, or in an even worse case, a vulnerability with the error reporting software can leak the passwords to the public. I guess the second point is fair.
- dozzie 10y agoYou don't have any way of defending against that stupid scenario, with or without centralized passwords. Additionally, most of the users would probably use the same password for each of the services anyway, so you have pretty much the same situation in both cases, only you don't have a quick and reliable way to invalidate all the passwords.