Confirmed users
400
edits
Services/Sync/Features/MigrateToDigestAuth: Difference between revisions
Services/Sync/Features/MigrateToDigestAuth (view source)
Revision as of 22:21, 30 August 2011
, 30 August 2011no edit summary
No edit summary |
No edit summary |
||
| Line 12: | Line 12: | ||
|Feature overview=Replace BasicAuth with more secure system where Sync web servers do not have access to cleartext passwords. This protocol can be DigestAuth, public/private key, etc, needs to be cleared with Security. | |Feature overview=Replace BasicAuth with more secure system where Sync web servers do not have access to cleartext passwords. This protocol can be DigestAuth, public/private key, etc, needs to be cleared with Security. | ||
|Feature users and use cases=Users using Sync will use more secure protocol (not BasicAuth) to authenticate access to Sync web servers. Passwords must not be passed around in plaintext. | |Feature users and use cases=Users using Sync will use more secure protocol (not BasicAuth) to authenticate access to Sync web servers. Passwords must not be passed around in plaintext. | ||
Migration:DigestAuth (strawman): will revert to BasicAuth once for calculating hash of password for authentication, and will use DigestAuth for all future authentication. | |||
Migration: | |||
DigestAuth (strawman): will revert to BasicAuth once for calculating hash of password for authentication, and will use DigestAuth for all future authentication. | |||
|Feature dependencies=Must discuss replacement authentication protocol with security people (bsmith?) | |Feature dependencies=Must discuss replacement authentication protocol with security people (bsmith?) | ||
|Feature non-goals=Hope to get ahead in setting up security necessary for running a sync-key server | |Feature non-goals=Hope to get ahead in setting up security necessary for running a sync-key server | ||