[Workaround] Security issues

Christoph Haas email at christoph-haas.de
Thu Nov 24 12:59:20 CET 2005


Daniel,

On Thursday 24 November 2005 12:21, Daniel Freitag wrote:
> So again I just can praise this howto, nice style and it just works!

Thanks. :)

> The only issue that annoys me is the clear-text password in the
> database. Isn't it a high security risk?

That's your decision. For me it's not. People who must not see the 
passwords have no access to the database server. The only risk I see is 
that if your database server is set up insecurely or gets hacked then all 
passwords can be "stolen".

> And even if not - I do not want 
> an email-account at a provider that is able to have a look at my
> password in plaintext.

An email account that can look at your password?

> Isn't it possible to at least store a md5 
> encrypted string of the password in the database?

Yes, it is. Look at the bits and pieces of the old tutorial at
http://workaround.org/articles/ispmail/old (Step 9).

 Christoph
-- 
~
~
".signature" [Modified] 2 lines --100%--                2,41         All



More information about the Workaround-chitchat mailing list