Re: [vwrap] authentication : remove reference to MD5

["Patnad Babii" <[e-mail]>]

I think if someday LL ask me to change my password because they made their 
security system better i would really not mind. So typing a password take 1 
minute for changing it.

Same for all opensim grid if they someday ask me to change my password 
because they enforced security i'd be more than happy to provide them with a 
new one.

I don't think people will leave SL just because you "forced" them to change 
a password honestly.

--------------------------------------------------
From: "Meadhbh Hamrick" <[e-mail]>
Sent: Tuesday, April 06, 2010 2:22 PM
To: "Peter Saint-Andre" <[e-mail]>
Cc: <[e-mail]>
Subject: Re: [vwrap] authentication : remove reference to MD5

> we need clarification about how much of the second life legacy
> protocol will be used in VWRAP.
>
> for instance. second life stores the MD5 hash of user passwords in the
> user database and uses it to authenticate users when logging in.
>
> but MD5 has some significant problems which were exacerbated several
> years ago when there was a security breach of linden's servers.
>
> so if we simply said "we're going to ditch MD5 in favor of SHA256"
> there would be a problem with reverse compatibility of the
> authentication data. this is because you can't generate the pre-image
> from an MD5 MIC and then use it to generate a SHA256 MIC. (or you
> can't do that in a way that insures that your MD5 pre image is the
> same as the password.)
>
> so in other words, there is an action we could take in this group that
> COULD make it very difficult for linden and presumably existing
> OpenSim instances to use the authentication protocol.
>
> so the question is, to which degree do we add an engineering burden to
> existing implementations that would like to adopt this group's output?
> the question of the two string identifier is a good one. linden could
> probably make systems that adhere to all sorts of different changes.
> but to what degree to we make it easy for existing implementers vs.
> the desires of people who have yet to build and implementation?
>
> -cheers
> -meadhbh
>
>
> --
> meadhbh hamrick * it's pronounced "maeve"
> @OhMeadhbh * http://meadhbh.org/ * [e-mail]
>
>
>
> On Tue, Apr 6, 2010 at 11:01 AM, Peter Saint-Andre <[e-mail]> 
> wrote:
>> On 4/6/10 8:19 AM, Meadhbh Hamrick wrote:
>>> okay.
>>>
>>> if we're going to remove VWRAP from all current implementations,
>>
>> What does that mean? I thought we were trying to build VWRAP into
>> implementations, not rip it out. :)
>>
>>> i
>>> vote we remove MD5 from the auth spec and replace it with a MIC with
>>> better security properties, like SHA224 or SHA256.
>>
>> +1 to more secure authentication.
>>
>> My quick reading of the authentication draft led me to think that it
>> needed a thorough review, but unfortunately I haven't had time to do
>> that yet.
>>
>> Peter
>>
>> --
>> Peter Saint-Andre
>> https://stpeter.im/
>>
>>
>>
>>
>> _______________________________________________
>> vwrap mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/vwrap
>>
>>
> _______________________________________________
> vwrap mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/vwrap
>