3 ms·

HMailServer has not SCRAM supports and the dev is not happy that we request it

2 points by neustradamus 5y ago

Martin Knafve, the hMailServer developer has a problem, he removes posts on the forum and close tickets on GitHub because he does not want to ADD more SECURITY: SCRAM supports: - https://github.com/hmailserver/hmailserver/issues/406 - https://github.com/hmailserver/hmailserver/issues/407 ----------- 20 November 2008: CRAM-MD5 to Historic: - https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00 29 June 2017: CRAM-MD5 to Historic: - https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00 July 2011: RFC6331: Moving DIGEST-MD5 to Historic: - https://tools.ietf.org/html/rfc6331 August 2021: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: "Replaced DIGEST-MD5 SASL mechanism with SCRAM-SHA-256. DIGEST-MD5 was deprecated." - https://tools.ietf.org/html/rfc9051 I add same about SCRAM-MD5. There are now: - July 2010: RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM): SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 (SCRAM-SHA-1 and SCRAM-SHA-1-PLUS) - July 2010: RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803 - November 2015: RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS: Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677 Soon: - SCRAM-SHA-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha-512 - SCRAM-SHA3-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha3-512 -------------------------------- There is a big security problem, the missing support of SCRAM-SHA-*. Can you add supports of : - SCRAM-SHA-1 - SCRAM-SHA-1-PLUS - SCRAM-SHA-256 - SCRAM-SHA-256-PLUS - SCRAM-SHA-512 - SCRAM-SHA-512-PLUS - SCRAM-SHA3-512 - SCRAM-SHA3-512-PLUS "When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]". - SCRAM-SHA-1(-PLUS): -- https://tools.ietf.org/html/rfc5802 -- https://tools.ietf.org/html/rfc6120 - SCRAM-SHA-256(-PLUS): -- https://tools.ietf.org/html/rfc7677 since 2015-11-02 -- https://tools.ietf.org/html/rfc8600 since 2019-06-21: https://mailarchive.ietf.org/arch/msg/ietf-announce/suJMmeMhuAOmGn_PJYgX5Vm8lNA - SCRAM-SHA-512(-PLUS): -- https://tools.ietf.org/html/draft-melnikov-scram-sha-512 - SCRAM-SHA3-512(-PLUS): -- https://tools.ietf.org/html/draft-melnikov-scram-sha3-512 https://xmpp.org/extensions/inbox/hash-recommendations.html -PLUS variants: - RFC5056: On the Use of Channel Bindings to Secure Channels: https://tools.ietf.org/html/rfc5056 - RFC5929: Channel Bindings for TLS: https://tools.ietf.org/html/rfc5929 - Channel-Binding Types: https://www.iana.org/assignments/channel-binding-types/channel-binding-types.xhtml - Channel Bindings for SCRAM over TLS 1.3: https://tools.ietf.org/html/draft-whited-tls-channel-bindings-for-tls13 -> https://tools.ietf.org/html/draft-ietf-kitten-tls-channel-bindings-for-tls13 IMAP: - RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2: https://tools.ietf.org/html/rfc9051 LDAP: - RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803 HTTP: - RFC7804: Salted Challenge Response HTTP Authentication Mechanism: https://tools.ietf.org/html/rfc7804 2FA: - Extensions to Salted Challenge Response (SCRAM) for 2 factor authentication: https://tools.ietf.org/html/draft-melnikov-scram-2fa IANA: - Simple Authentication and Security Layer (SASL) Mechanisms: https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml Linked to: - https://github.com/scram-xmpp/info/issues/1

dchest 5y ago
Please stop harassing open source developers.
dave4420 5y ago
It’s free software, so if you are not happy with the developer’s behaviour you are able to fork it and add these features yourself.
outsomnia 5y ago
The author doesn't owe anyone anything... including answering issues on github instead of getting on with his day. If you want this feature, you could add it, or pay someone to add it, and send the original author a patch so everyone can share your work like you're sharing the author's work.
maxbaines 5y ago
Rather you have a problem with the developer. I would suggest maybe you try another solution.
r_hoods_ghost 5y ago
Have you offered to pay him market rate to implement it? If yes and he doesn't want to, fork the project and pay another dev to do so and then see whether he is willing to merge the feature. If not, maintain your new fork. If you haven't done the above then you have no right to demand that someone performs work for your benefit for free.

2 points by neustradamus 5y ago

dchest 5y ago

Please stop harassing open source developers.

dave4420 5y ago

It’s free software, so if you are not happy with the developer’s behaviour you are able to fork it and add these features yourself.

outsomnia 5y ago

The author doesn't owe anyone anything... including answering issues on github instead of getting on with his day. If you want this feature, you could add it, or pay someone to add it, and send the original author a patch so everyone can share your work like you're sharing the author's work.

maxbaines 5y ago

Rather you have a problem with the developer. I would suggest maybe you try another solution.

r_hoods_ghost 5y ago

Have you offered to pay him market rate to implement it? If yes and he doesn't want to, fork the project and pay another dev to do so and then see whether he is willing to merge the feature. If not, maintain your new fork. If you haven't done the above then you have no right to demand that someone performs work for your benefit for free.