From: Martin Langhoff <martin.langhoff@gmail.com>
Date: Tue, 18 Dec 2007 20:39:20 GMT
Subject: Re: [PATCH] Authentication support for pserver
Message-ID: <46a038f90712181239g3c6fe69bs822fd689d4628b5@mail.gmail.com>
In-Reply-To: <46a038f90712180141x2f27e6cei5ef53339fd3f90dc@mail.gmail.com>

On Dec 18, 2007 10:41 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:
>  - git/config is very likely to be readable if the site is served via
> other means, like dumb http protocol, or git+ssh. So even if the
> password scrambling is mickey-mouse. it might make sense to force the
> password data to live elsewhere.

On this aspect, I see no reason why we wouldn't have the passwords
crypt()ed or SHA1'd. Perl includes crypt() in the default
distribution, so it wouldn't add any dependency.

The protocol may be ROT13'ing the passwords, but we don't have to
double-ROT13 them in our storage format ;-)

cheers,


martin