Clear text passwords

[Engle, Perry]

Hello - It's been happening for a while, but it's really (really) time to end
storing clear text passwords in the database.  It's *LONG* past time to send them in
email to your users.

If you'd like proof, go to

http://plaintextoffenders.com/submit
And
http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...

Of all places, Fedora and Red Hat should be leading this charge.

Thanks for listening,

Perry Engle
Lead Cyber Security Engineer, Section Leader
The MITRE Corporation, Department G026
(o) 781-271-2349 (m) 617-893-0058

[Tom Callaway]

On 11/05/2012 05:04 PM, Engle, Perry wrote:
>  Hello – It’s been happening for a while, but it’s really (really)
> time
>  to end storing clear text passwords in the database.  It’s **LONG** past
>  time to send them in email to your users.
>  
>   
>  
>  If you’d like proof, go to
>  
>   
>  
>  http://plaintextoffenders.com/submit
>  
>  And
>  
>  http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...
>  
>   
>  
>  Of all places, Fedora and Red Hat should be leading this charge. 
Hi Perry.

Thanks for your email. We are currently working on an initiative called
"Hyperkitty", which is a rewrite of the Mailman3 Archiver code. Part of
this initiative (a very small part) includes the removal of plain-text
passwords.

For more information about this project, please see:

http://aurelien.bompard.org/post/2012/10/17/Progress-on-HyperKitty

Additionally, back in March, we disabled user password settings as much
as possible in the existing Mailman 2 environments:

http://smoogespace.blogspot.com/2012/04/mailman-passwords-how-fedora-it-i...

While mailman still sends a clear-text password back to the user upon
request, it is a throw-away password.

If there are other areas where you believe we are handling passwords
insecurely, please point them out to us.

Thanks again,

Tom Callaway
Fedora Engineering Manager

==
Fedora Project

[Kévin Raymond]

Le lundi 05 nov. 2012 à 22:04:07 (+0000), Engle, Perry a écrit : 
>  Hello - It's been happening for a while, but it's really
> (really) time to end storing clear text passwords in the database.  It's *LONG* past
> time to send them in email to your users.
>  
>  If you'd like proof, go to
>  
>  http://plaintextoffenders.com/submit
>  And
>  http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...
>  
>  Of all places, Fedora and Red Hat should be leading this charge. 
Hi,

I suppose you refer to the Mailman monthly reminder?
I agree, we can ask all the mailing lists admin to disable this "feature".
Just asked to our infra team[1].
Please note that only few lists are really maintained by US, the Fedora Project.
Others are maintained by some community groups. If we don't DO this, we could of
course ask them to take action. Will see with the infrastructure group.

In the Fedora Project, we don't store any plain text passwords, so if you think
about something else, please explain better.

Many thanks,

[1] https://fedorahosted.org/fedora-infrastructure/ticket/3553


-- 
Kévin Raymond
(Shaiton)

[Stephen John Smoogen]

On 6 November 2012 08:34, Kévin Raymond <shaiton(a)fedoraproject.org&gt; wrote:
>  Le lundi 05 nov. 2012 à 22:04:07 (+0000), Engle, Perry a écrit :
> > Hello - It's been happening for a while, but it's really (really) time to end
> storing clear text passwords in the database.  It's *LONG* past time to send them in
> email to your users.
> >
> > If you'd like proof, go to
> >
> > http://plaintextoffenders.com/submit
> > And
> > http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...
> >
> > Of all places, Fedora and Red Hat should be leading this charge.
>
>  Hi,
>
>  I suppose you refer to the Mailman monthly reminder?
>  I agree, we can ask all the mailing lists admin to disable this "feature".
Originally the passwords were set up in the default way but this
spring I changed many of the users passwords to the randomly chosen
method (16 character random string). I removed all ways for the user
to change the password so the only way for them to know what the
password is via a reminder.

I looked at that time on either hashing the passwords in mailman or
some other method, and it was non-trivial. I am waiting for the
hyperkitty implementation for a real fix.



-- 
Stephen J Smoogen.
"Don't derail a useful feature for the 99% because you're not in it."
Linus Torvalds
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me."  —James Stewart as Elwood P. Dowd

[Engle, Perry]

Hello all, and thanks for your quick and thoughtful replies.  

I only realized today that I didn't send a copy of the message I was referring to - it
is a monthly mailing and is below.

Yes, I had not noticed that the auto-email could be disabled - which I did, and agree that
it should be set administratively if at all possible.

I'm encouraged that you're working on complete a solution to this, too, and thanks
for the references to the blog posts.

Perry Engle


-----Original Message-----
From: mailman-bounces(a)lists.fedorahosted.org
[mailto:[e-mail]] On Behalf Of
mailman-owner(a)lists.fedorahosted.org
Sent: Thursday, November 01, 2012 1:06 AM
To: Engle, Perry
Subject: lists.fedorahosted.org mailing list memberships reminder

This is a reminder, sent out once a month, about your
lists.fedorahosted.org mailing list memberships.  It includes your
subscription info and how to use it to change it or unsubscribe from a
list.

You can visit the URLs to change your membership status or
configuration, including unsubscribing, setting digest-style delivery
or disabling delivery altogether (e.g., for a vacation), and so on.

In addition to the URL interfaces, you can also use email to make such
changes.  For more info, send a message to the '-request' address of
the list (for example, mailman-request(a)lists.fedorahosted.org)
containing just the word 'help' in the message body, and an email
message will be sent to you with instructions.

If you have questions, problems, comments, etc, send them to
mailman-owner(a)lists.fedorahosted.org.  Thanks!

Passwords for pengle(a)mitre.org:

List                                     Password // URL
----                                     --------  
trusted-computing(a)lists.fedorahosted.org
           [password was here]
https://lists.fedorahosted.org/mailman/options/trusted-computing/pengle%4...

lumberjack-developers(a)lists.fedorahosted.org
           [and here]
https://lists.fedorahosted.org/mailman/options/lumberjack-developers/peng...


-----Original Message-----
From: Stephen John Smoogen [mailto:[e-mail]] 
Sent: Tuesday, November 06, 2012 11:29 AM
To: Kévin Raymond
Cc: Engle, Perry; webmaster(a)fedoraproject.org
Subject: Re: Clear text passwords

On 6 November 2012 08:34, Kévin Raymond <shaiton(a)fedoraproject.org&gt; wrote:
>  Le lundi 05 nov. 2012 à 22:04:07 (+0000), Engle, Perry a écrit :
> > Hello - It's been happening for a while, but it's really (really) time to end
> storing clear text passwords in the database.  It's *LONG* past time to send them in
> email to your users.
> >
> > If you'd like proof, go to
> >
> > http://plaintextoffenders.com/submit
> > And
> > http://krebsonsecurity.com/2012/06/naming-and-shaming-the-plaintext-offen...
> >
> > Of all places, Fedora and Red Hat should be leading this charge.
>
>  Hi,
>
>  I suppose you refer to the Mailman monthly reminder?
>  I agree, we can ask all the mailing lists admin to disable this "feature".
Originally the passwords were set up in the default way but this
spring I changed many of the users passwords to the randomly chosen
method (16 character random string). I removed all ways for the user
to change the password so the only way for them to know what the
password is via a reminder.

I looked at that time on either hashing the passwords in mailman or
some other method, and it was non-trivial. I am waiting for the
hyperkitty implementation for a real fix.



-- 
Stephen J Smoogen.
"Don't derail a useful feature for the 99% because you're not in it."
Linus Torvalds
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me."  -James Stewart as Elwood P. Dowd