chmod 600 user config file, hash client side password on registration…

vilmibm / tildemush

a modern mush tailored to tilde town

GNU General Public License v3.0

42 stars 12 forks source link

Closed selfsame closed 5 years ago

selfsame commented 5 years ago

… (probably a bad idea)

The thing here is:

user files are generally considered secure with the right permissions
hashing user password on client with a salt means it's only recoverable from the config file, the user entered password wouldn't grant access to the account

vilmibm commented 5 years ago

it's a good idea, but my (unstated) plan was to solve this problem with a secured transport layer -- just hadn't gotten to setting it up yet.