passwords in plain text

[gregf]

Currently jabberd2 is storing users passwords in plain text. Would be nice to see these stored in a hash of some sort. I have only tried jabberd2 with mysql, if they are hashed using other methods please correct me.

[smoku]

If we want to transfer hashed passwords on the wire (SASL DIGEST-MD5 and XEP-0078 SHA1 digest), we need to store passwords in plain, to be able to generate same hashes in server for comparison with provided one.

If we want to store password hashes, we need to get plaintext password on the wire (SASL PLAIN and XEP-0078 plain), to be able to generate hash in server for comparison with stored one.

RFC3920 requires SASL DIGEST-MD5 implementation, so to archive that we need plaintext passwords in storage. We also value wire sniffing protection more, than storage hijacking protection.

Of course it may be deployment decision to allow only PLAIN authentication methods and store hashed password, so it would be nice to allow this.

It's also worth noting here, that XSF is working on depreciating DIGEST-MD5 authentication. One of the proposed replacements is PLAIN + enforced TLS.

[smoku]

In [572]: Merged crypted passwords support for MySQL. Closes #184 and 197