Re: passwords in the clear

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

John McMeeking writes:
> It seems like changing passwords in the clear would present similar issues.
> If someone can snoop for bind requests, it wouldn't seem much harder to
> also snoop for password change operations (password modify extended op,
> modify of userPassword, etc.).
> 
> Do we want to consider extending this to cover that?

Sounds good to me.  I don't think it can be made a MUST, though:
If there are any LDAP servers left that merely forward requests to other
servers, e.g. X.500 servers, then the LDAP server might not know that a
particular attribute type contains passwords.  So it can't return
confidentialityRequired if the user tries to modify that password using
cleartext.  Of course, the X.500 server might return
confidentialityRequired, or whatever that is in X.500 speak, anyway.

> Chris Newman wrote:
>    (...)
>    Use of simple bind sends passwords in the clear.  This can be
>    avoided by using SASL bind [SASL] with a mechanism
>    that does not use plaintext passwords, by first negotiating
>    encryption via STARTTLS or some other protection mechanism.
>    (...)

-- 
Hallvard