On Fri, Aug 21, 2015 at 01:58:46AM +0200, denis wrote:
On 20/08/2015 14:40, Job Snijders wrote:
I think all in the group agree that it would be very nice if you can perform 100% of all operations without the need for any MD5-PW. I'll even go as far as stating that we should not be looking at successors such as SHA3-PW, let's leap forward and make the PW auth concept entirely obsolete. :-)
Why? I have never understood this almost religious obsession to get rid of passwords in the RIPE Database. Most of you life online involves passwords.
https://www.google.nl/webhp?#safe=on&q=passwords+suck :-) I personally prefer asymmetric forms of authentication: should there be an incident or we at some point realise we should not have exposed certain aspects, there is nothing of value in the internal DB except public components of asymmetric methods.
Including lots of financial, legal and government interactions. What makes the RIPE Database so much more important that it should not use passwords?
Their function in society does not automatically designate them as proper thought leaders ;-)
When it was suggested to hide the password hash I thought that was a mistake. We should have hidden the whole MNTNER object from public view. Why does anyone outside of my organisation need to see anything in my MNTNER object? Why should you know if I use a password or PGP or whatever? This is my business not yours.
This seems to play into another thread, where someone had trouble retrieving the proper value of some "auth:" lines. It would be worth exploring how we can hide all "auth:" lines yet make them easily accessible to the owner. Kind regards, Job