From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Tue, 18 Dec 2007 21:10:28 GMT
Subject: Re: [PATCH] Authentication support for pserver
Message-ID: <51dd1af80712181310q38255593t989be64799be2e0e@mail.gmail.com>
In-Reply-To: <46a038f90712181238p7529a02bmde21c89956a3f641@mail.gmail.com>

On Dec 18, 2007 8:38 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:
> On Dec 18, 2007 10:41 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:
> >  - git/config is very likely to be readable if the site is served via
> > other means, like dumb http protocol, or git+ssh. So even if the
> > password scrambling is mickey-mouse. it might make sense to force the
> > password data to live elsewhere.
>
> On this aspect, I see no reason why we wouldn't have the passwords
> crypt()ed or SHA1'd. Perl includes crypt() in the default
> distribution, so it wouldn't add any dependency.

It also includes Digest::SHA in the default distribution as of today:)

I could add another option for allowing users to choose their password
storage, e.g.:

[gitcvs]
    password_storage = plaintext # or sha1, crypt, ...