Full Disclosure: Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords

[Васил Колев <vasil () ludost net>]

На ?, 2003-06-03 в 18:31, IRCXpro Support записа:
> Reply to Feedback from Darren:
>
> > Firstly, there has been support for storing passwords, encrypted, in
> > configuration files on Unix for over 10 years, if not longer.  I can
> The reason why IRC servers "IRCD.config" files don't use encryption (see
> file attachment for example) is because 49 times out of 50 they do not come
> with a GUI program.  Administrators main method of changing the
> configuration is to manually edit the file using a notepad utility.
Ok, I'll bite :)
Anyone, who needs a 'gui' to edit it's ircd.conf file, and, because not
having one, uses Notepad, shouldn't be doing it in the first place...
There are a lot of irc networks now, and being ircadmin in one
medium/small network, I can tell you, that every one, who has server in
this network, uses encrypted passwords. They're easy to work with
(although, a little more difficult than plaintext passwords) and
everyone has mkpasswd or something else installed. In fact, if you offer
a gui to config the servers, a lot of people will ask "what's the
problem with the old method?"

Also, there is the issue of knowing someone's password - let's say, that
only one is editing the conf file, and he doesn't need and want to know
the password for every oper there. So what? He just asks them for their
encrypted passwords, and that's all, so even if they reuse the password
that they gave you somewhere, you're safe to say that you didn't use
it/leak it (although you can still sniff it in a lot of ways).

There are a lot of reasons to store the passwords encrypted... And not
that much reasons to store them unencrypted - in fact, there is only one
good reason that i can think of, and it's the need to retrieve lost
passwords, but the best way to do that, is to keep a hardened database
of the unencrypted passwords, and use it for this sole purpose.

Attachment: signature.asc
Description: This is a digitally signed message part