Re: Clear text passwords

[Tom Callaway]

On 11/05/2012 05:04 PM, Engle, Perry wrote:
>  Hello – It’s been happening for a while, but it’s really (really)
> time
>  to end storing clear text passwords in the database.  It’s **LONG** past
>  time to send them in email to your users.
>  
>   
>  
>  If you’d like proof, go to
>  
>   
>  
>  http://plaintextoffenders.com/submit
>  
>  And
>  
>  http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...
>  
>   
>  
>  Of all places, Fedora and Red Hat should be leading this charge. 
Hi Perry.

Thanks for your email. We are currently working on an initiative called
"Hyperkitty", which is a rewrite of the Mailman3 Archiver code. Part of
this initiative (a very small part) includes the removal of plain-text
passwords.

For more information about this project, please see:

http://aurelien.bompard.org/post/2012/10/17/Progress-on-HyperKitty

Additionally, back in March, we disabled user password settings as much
as possible in the existing Mailman 2 environments:

http://smoogespace.blogspot.com/2012/04/mailman-passwords-how-fedora-it-i...

While mailman still sends a clear-text password back to the user upon
request, it is a throw-away password.

If there are other areas where you believe we are handling passwords
insecurely, please point them out to us.

Thanks again,

Tom Callaway
Fedora Engineering Manager

==
Fedora Project