5 ms·

https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/view/head:/src/mailman/model/user.py https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie... Li

https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/view/head:/src/mailman/model/user.py https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie... Line 56: _password = Column('password', Unicode)

rspeer 12y ago
Most of the way I'm reminded that a list I'm on uses Mailman is that it mails me my password in plain text every month. So, it's unfortunate, but it's nothing new.
- golem_de 12y ago
  Sorry, I couldn't resist. Look on that 'user' table! Does anyone have a copy of lists.mozilla.org? hehe
  - andrewstuart 12y ago
    Can you help me understand the issue you see here?
- rbehrends 12y ago
  As I understand it from the write-up (and a brief look at the source seems to confirm that), Mailman 3.0 does encrypt passwords by default and does not mail them out any longer. It is stored in unicode because that's what passlib hash algorithms return, not because there's an underlying plaintext representation.
  - hobarrera 12y ago
    It hashes password. Encrypting them indicates there's a way to decrypt them. Hashing, by definition, is not possible (not practical, really).
- listic 12y ago
  If there are better mailing list software, what are they?
gog 12y ago
From the text: "To answer the question that at least a few dozen of you are looking for: Mailman 3 will not, by default, send you a monthly reminder that includes your password in plain text. In fact, it can't; Mailman 3 hashes passwords before storing them."
deleted 12y ago
[deleted]
- rbehrends 12y ago
  > But the code you are pointing out is not using hashing(&salting) at all, I'm confused. That's just the storage backend. Encryption is not handled at this layer, but at (e.g.): https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/view/head:/src/mailman/rest/users.py#L108 https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie...

5 ms·

https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/view/head:/src/mailman/model/user.py https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie... Li

by golem_de 12y ago

rspeer 12y ago
Most of the way I'm reminded that a list I'm on uses Mailman is that it mails me my password in plain text every month. So, it's unfortunate, but it's nothing new.
- golem_de 12y ago
  Sorry, I couldn't resist. Look on that 'user' table! Does anyone have a copy of lists.mozilla.org? hehe
  - andrewstuart 12y ago
    Can you help me understand the issue you see here?
- rbehrends 12y ago
  As I understand it from the write-up (and a brief look at the source seems to confirm that), Mailman 3.0 does encrypt passwords by default and does not mail them out any longer. It is stored in unicode because that's what passlib hash algorithms return, not because there's an underlying plaintext representation.
  - hobarrera 12y ago
    It hashes password. Encrypting them indicates there's a way to decrypt them. Hashing, by definition, is not possible (not practical, really).
- listic 12y ago
  If there are better mailing list software, what are they?
gog 12y ago
From the text: "To answer the question that at least a few dozen of you are looking for: Mailman 3 will not, by default, send you a monthly reminder that includes your password in plain text. In fact, it can't; Mailman 3 hashes passwords before storing them."
deleted 12y ago
[deleted]
- rbehrends 12y ago
  > But the code you are pointing out is not using hashing(&salting) at all, I'm confused. That's just the storage backend. Encryption is not handled at this layer, but at (e.g.): https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/view/head:/src/mailman/rest/users.py#L108 https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie...