search

duesee / imap-next

Apache License 2.0
11 stars 3 forks source link

SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) + SCRAM-SHA3-512(-PLUS) supports #96

Open Neustradamus opened 9 months ago

Neustradamus commented 9 months ago

Dear @duesee,

Can you add supports of :

You can add too:

"When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-256 variants [RFC7677] SHOULD be preferred over SHA-1 variants [RFC5802]".

https://xmpp.org/extensions/inbox/hash-recommendations.html

-PLUS variants:

IMAP:

LDAP:

HTTP:

2FA:

IANA:

Linked to:

gowthamgts commented 6 months ago

https://news.ycombinator.com/item?id=39868682

Neustradamus commented 6 months ago

@gowthamgts: Do you attack me because I have requested the XZ update? I am not linked to the XZ project.

duesee commented 6 months ago

Thanks for the hint, @gowthamgts!

Some thoughts (and context):

This issue asks to implement support for some SCRAM variants -- it doesn't "push for changes to sha256" as said on HN. To the best of my knowledge, there is nothing wrong with SCRAM -- to the contrary. Thus, I believe @Neustradamus opened this issue in good faith.

Still, while you are here:

SASL is old and complex. It's also literally the key to our online identity. Yet, it feels under-researched. Maybe we can use our energy to take a closer look on SASL implementations?

(While I can't do much research on my own currently, I will happily assist anyone wanting to do so with tooling, expertise, etc.! Want to see that happen for quite some time now...)

gowthamgts commented 6 months ago

@Neustradamus definitely no. At this point in time I just wanted to be sure that people knew about the backdoor. You can definitely be a genuine user or a developer or a contributor or even a penguin on the internet. 🙂

@duesee understood. No harm no foul. These PRs were flagged by people earlier and just wanted to make sure this reached the maintainers of the projects.

Neustradamus commented 6 months ago

@duesee: Thanks for your answer, several people mix all.

@gowthamgts: Strange, your messages are not clear:

You can follow my announcements here:

The good point, people speak about SCRAM "Salted Challenge Response Authentication Mechanism" security ;)

Badly, some people or projects like only old unsecure mechanisms, some would like security improvements.

cc: @canselcik, @winkelcode, @timrobbins1, @sebpretzer, @sroussey, @masklinn, @asmor (not sure).

mbhangui commented 6 months ago

@Neustradamus had requesed me too for implementation of SCRAM (See this). What he has asked me to add is something which is genuine and supported by many RFCs. Implementation of those RFC's in my project was what he pursued. Apart from the followup on SCRAM implementation he has been helpful in few occassions to better organize my projects on github. At no point has he suggested me to include any code apart from suggesting which projects that have implemented SCRAM. IME he has always been sincere in interactions with me.

LeoniePhiline commented 6 months ago

@Neustradamus Please stop CCing people who reacted to an issue comment.

Neustradamus commented 6 months ago

@LeoniePhiline: Sorry, thanks for your message. It is important to understand all and not a little part :)

gowthamgts commented 6 months ago

@Neustradamus I've already explained here dude. I don't understand why you keep spamming and ccing me everywhere. If you're not guilty just move on.

Neustradamus commented 6 months ago

Why? Because people contact me about it. It is important to have the detail on linked publications because a lot of people do not click on other links directly.

duesee commented 6 months ago

Thanks for the comments, but I feel this discussion is a bit of a distraction. If you disagree, write me an email and I'll unlock the discussion again.