Re: authmeth: removal of DIGEST-MD5

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 12:27 PM 10/13/2005, Hallvard B Furuseth wrote:
>CRAM-MD5 seems to be the only alternative mechanism which is widely
>enough deployed to suggest now.  That mechanism apparently has its own
>problems, though.  So I suggest to keep the DIGEST-MD5 reference. 

I note that while CRAM-MD5 and DIGEST-MD5 don't expose the
actual password, they do expose a hash of that password that
is quite prone to offline dictionary attacks.  I'd argue
that you need to be just as careful as to whom you give
that hash to as you are giving out the actual password.

Kurt