RE: RFC2256: userPassword

[Paul Leach <paulle@microsoft.com>]

> -----Original Message-----
> From: JR Heisey [mailto:jr.heisey@mediagate.com]
> Sent: Thursday, July 01, 1999 2:15 PM
> To: Paul Leach
> Cc: ietf-ldapext@netscape.com
> Subject: Re: RFC2256: userPassword
> 
> 
> My problem with this is that it gives the third party
> software access to all of my (assuming I'm the accounting
> system user) access to LDAP user information and possibly
> access to anything else that I have rights to. Which may or
> may not be a problem.

In _all_ the cases you presented, the third party software had your
password, in the clear. In which case, if it isn't trustworthy, it has
access to everything you hold dear. (Everything accessible with that
password, anyway.)