Rails - May 2009 - Re: A Letter to the Authors of Web Authentication Libraries

Yep!

Out of interest, what''s your take on when a user wants to retrieve  
their password? Not talking about regeneration or resetting here, tho  
that works.

Blog: http://random8.zenunit.com/
Learn: http://sensei.zenunit.com/
Twitter: http://twitter.com/random8r

On 04/05/2009, at 11:32 PM, Paul Johnston
<paul.paj-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>
> Hi,
>
> Many web sites have a user name and password login system, and do not
> use SSL. As a consequence, users'' passwords are transmitted over
the
> internet unencrypted. This puts them at risk, particularly if the user
> is on a shared ethernet segment, or open wireless network.
>
> For many years I have provided a JavaScript MD5 library (http://
> pajhome.org.uk/crypt/md5/), which can be used to perform a challenge-
> response login. This avoids passwords being transmitted unencrypted,
> although the security is not as strong as SSL. A number of web sites
> currently use this technique; for some years Yahoo did, although they
> now have SSL login.
>
> However, the use of JavaScript MD5 is not widespread. I think this is
> because few authentication libraries support it. It is possible for a
> library to provide JavaScript MD5 as an authentication mechanism, with
> the details hidden from the application developer. In fact, it''s
quite
> easy to implement, and there is a lot of guidance on my site.
>
> So, this is a call to the authors of all web authentication libraries.
> Add JavaScript MD5 as an authentication mechanism. And then let me
> know, so I can link to you from my site. If you need any help
> implementing it, drop me a line, I''ll do what I can.
>
> I think supporting this mode would be a big selling point for any
> authentication library. And if support becomes widespread, the
> internet becomes a little bit safer for everyone.
>
> Best wishes,
>
> Paul
>
> [This was rejected on the rails-core list, but I believe it is
> relevant to the Rails community]
>
> >

Hi,
> Out of interest, what''s your take on when a user wants to retrieve
 
> their password? Not talking about regeneration or resetting here, tho  
> that works.
My take is that there should be no way for the user to retrieve their
password. Forgotten password should generate an code that is sent to
their email, usually within a link, and when the user clicks the link
they get a chance to set a new password.

If you really want users to be able to retrieve passwords, you can
always store them in the database as plaintext. I don''t recommend it
though.

Paul