W3C home > Mailing lists > Public > www-tag@w3.org > June 2008

delegation and passwordsInTheClear-52

From: Dan Connolly <connolly@w3.org>
Date: Wed, 25 Jun 2008 09:30:20 -0500
To: www-tag <www-tag@w3.org>, public-usable-authentication@w3.org
Message-Id: <1214404220.11021.262.camel@pav.lan>

I wonder about this:

"Every scenario that involves possibly transmitting passwords in the
clear can be redesigned for the desired functionality without a
cleartext password transmission."
  -- http://www.w3.org/2001/tag/doc/passwordsInTheClear-52-20080602

W3C has tried to stamp out cleartext passwords on its own
web site a few times, but one of the main blockers, aside from
buggy support for digest in various bits of software, is delegation.

W3C has a few forms-based services that use
cleartext passwords for delegation; e.g. our XSLT service
  http://www.w3.org/2005/08/online_xslt/#authinfo

If you want to use the service on password-protected pages,
you just put the credentials in a form and it uses them.

The main use case is password-protected pages inside w3.org
(though I'm not sure that's technically enforced) so it's
not really all *that* much less secure than sending credentials
to get the actual password-protected page. Still, yes,
it makes many of us uncomfortable.

How can these delegated services be "redesigned for the desired
functionality without a cleartext password transmission."

The W3C systems team has been looking at this for several
years without finding a solution.

-- 
Dan Connolly, W3C http://www.w3.org/People/Connolly/
gpg D3C2 887B 0F92 6005 C541  0875 0F91 96DE 6E52 C29E
Received on Wednesday, 25 June 2008 14:29:10 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Thursday, 26 April 2012 12:47:58 GMT