Forum OpenACS Q&A: Re: Password in ClearText

Lars, that is good news about the login pages using SSL if it's available.  I was wondering: when is the determination made about whether or not to use SSL?  For example if SSL is incorrectly installed or is uninstalled, does openACS stop using it automatically, or is this something that is settable in the admin panel?  (I'd hope the latter so that an error would be generated if SSL were not available.)

Jeff, that's right, OpenACS could use either Digest Authentication, or JavaScript for a home-brew implementation.  Do the major browsers not support these?Possibly there could be issues with Digest and old versions of Netscape, since as I recall Netscape had some complaints with the protocol, but I think these were resolved years ago, e.g., 1999 or so.  Really old versions of other browsers don't support it either since the protocl didn't exist.  I am not sure why you think Digest-like hashing in JavaScript is a waste -- it would acomplish essentially the same thing as Digest.  I do agree that having the option to use Digest in OpenACS would be nice.

Tom, Digest prevents simple replay attacks.  It is susceptible to more sophisticated attacks but it's more secure than "Basic Authentication".  And you are right that Digest doesn't solve the problem of how to establish the shared secret in the first place.  But just because there are insecurities with this protocol doesn't make it useless -- it is generally a lot better than doing nothing!

Tom, it's not at all clear to me why you couldn't use digest authentication on the page that grants the auth token. Maybe you could elaborate here on why that wouldn't work...

Andrew, I say javascript is a waste since most of the painful authentication experiences I have had have been with ecommerce sites who have "rolled their own" in javascript. Of course you can say "just get it right and everything works smoothly and if someone turns off javascript they just can't use the site" but I think given that ssl will just work and is in fact much more secure it's a waste to add something that will definitely lock some people out and provides only a moderate amount of security and especially a waste if we could make digest authentication work for granting auth tokens.

I do think we got the ssl side right (with the notion of secure and insecure tokens, an easy way to restrict parts of the site to ssl, and login using ssl by default assuming ssl is available). I think we should have a way to say "disable logins if ssl is unavailable" but I expect that would not be at all hard to add.