[Workaround] Security issues
Christoph Haas
email at christoph-haas.de
Thu Nov 24 12:59:20 CET 2005
Daniel,
On Thursday 24 November 2005 12:21, Daniel Freitag wrote:
> So again I just can praise this howto, nice style and it just works!
Thanks. :)
> The only issue that annoys me is the clear-text password in the
> database. Isn't it a high security risk?
That's your decision. For me it's not. People who must not see the
passwords have no access to the database server. The only risk I see is
that if your database server is set up insecurely or gets hacked then all
passwords can be "stolen".
> And even if not - I do not want
> an email-account at a provider that is able to have a look at my
> password in plaintext.
An email account that can look at your password?
> Isn't it possible to at least store a md5
> encrypted string of the password in the database?
Yes, it is. Look at the bits and pieces of the old tutorial at
http://workaround.org/articles/ispmail/old (Step 9).
Christoph
--
~
~
".signature" [Modified] 2 lines --100%-- 2,41 All
More information about the Workaround-chitchat
mailing list