<p dir="ltr">Yeah, showing a notice for now is good so new subscribers know the dangers. But I still would rather see an active attempt at keeping passwords safe. Even though someone cracking the database won't be able to do much with my one off password, I still prefer to err on the side of doing right and actively avoiding the situation. </p>
<p dir="ltr">A cloud service sounds interesting since it would almost always be up to date (I depend on my WordPress site to auto update itself and the php runtime since I know I'm too lazy to manually do it). </p>
<br><div class="gmail_quote"><div dir="ltr">On Thu, Nov 5, 2015, 14:16 Chris de Groot <<a href="mailto:cdegroot@adobe.com">cdegroot@adobe.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>My recommendation is we must figure out a way to secure the passwords. It’s cool and stuff to run the service, but it is too much of a danger as it stands today, we must assume it will get stolen and that not everyone will read the notes on how to select
a password for the mail list. I think it would be valid to consider a hosted community service that takes away all these responsibilities from the folk who provide enough time to keep it running, but maybe not enough time to keep it safe. Google groups maybe
an option.</div>
<div><br>
</div>
<div>C.</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Lab <<a href="mailto:lab-bounces@artengine.ca" target="_blank">lab-bounces@artengine.ca</a>> on behalf of Jean-Marc LeBlanc <<a href="mailto:jeanmarc.leblanc@gmail.com" target="_blank">jeanmarc.leblanc@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, November 5, 2015 at 2:53 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:peters-modlab@techwiz.ca" target="_blank">peters-modlab@techwiz.ca</a>" <<a href="mailto:peters-modlab@techwiz.ca" target="_blank">peters-modlab@techwiz.ca</a>><br>
<span style="font-weight:bold">Cc: </span>lab <<a href="mailto:lab@artengine.ca" target="_blank">lab@artengine.ca</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Lab] Plain text password<br>
</div></span></div><div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif"><span>
<div><br>
</div>
<div>
<div>
<div dir="ltr">If there no history, I don't mind just chaining the password. but it might be worth mentioning. Maybe indicate when you sign up not to reuse a password and have it entirely unique to this site.<br>
</div>
<div class="gmail_extra"><br clear="all">
<div>
<div><br>
Jean-Marc Le Blanc<br>
---<br>
</div>
</div>
<br>
<div class="gmail_quote">On Wed, Nov 4, 2015 at 10:28 AM, Peter Sjoberg <span dir="ltr">
<<a href="mailto:lpaseen@gmail.com" target="_blank">lpaseen@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA512<br>
<span><br>
On 11/01/2015 10:31 AM, Jean-Marc LeBlanc wrote:<br>
> I just noticed that the database for the modlab mailing list keeps<br>
> passwords in plain text rather than a salted hash.<br>
</span>When you signed up you should have seen something like<br>
"You may enter a privacy password below. This provides only mild<br>
security, but should prevent others from messing with your subscription.<br>
Do not use a valuable password as it will occasionally be emailed back<br>
to you in cleartext."<br>
(at least if you used <a href="http://artengine.ca/mailman/listinfo/lab" rel="noreferrer" target="_blank">
http://artengine.ca/mailman/listinfo/lab</a>)<br>
<br>
note the "may", if no password is entered a random one is created and<br>
that's normally what I do.<br>
<br>
It's an old discussion about it at<br>
<a href="https://www.mail-archive.com/mailman-users@python.org/msg60018.html" rel="noreferrer" target="_blank">
https://www.mail-archive.com/mailman-users@python.org/msg60018.html</a><br>
- From one of those posts:<br>
"The best I can tell, your expectations for Mailman's security and the<br>
software authors' expectations are completely different. As has already<br>
been explained, it is a low level of security designed to prevent (maybe<br>
I should just say discourage) mischief. It is not intended to be as<br>
secure as what secures your bank accounts. If your Mailman password is<br>
compromised, what is the most damage that can be done? Very little."<br>
<span><br>
><br>
> Does it keep a history of passwords?<br>
</span>since you can put same psw as new psw I can't see it having history<br>
anywhere.<br>
<span><br>
> Could I have all my passwords<br>
> scrubed from the data base?<br>
</span>quick check on my own mailman list I see the psw in<br>
/var/lib/mailman/lists/[listnam]/config.pck and it seems like best way<br>
to go is to change your password to some random string.<br>
<br>
/ps<br>
<span><br>
<br>
><br>
><br>
><br>
> _______________________________________________<br>
> Lab mailing list<br>
> 1. subscribe <a href="http://artengine.ca/mailman/listinfo/lab" rel="noreferrer" target="_blank">
http://artengine.ca/mailman/listinfo/lab</a><br>
> 2. then email <a href="mailto:Lab@artengine.ca" target="_blank">Lab@artengine.ca</a> to send your message to the list<br>
><br>
</span>-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
Comment: Using GnuPG with Thunderbird - <a href="http://www.enigmail.net/" rel="noreferrer" target="_blank">
http://www.enigmail.net/</a><br>
<br>
iQIVAwUBVjokGyRVDohC3d3dAQoMwRAAhsJu+WXTAlINzrOxajDdh5jV+SFvv1gi<br>
SDcxeiGQEumRj2qcsg5beu8YyoaPxIjwk7kbxMypEbxw82fYlo/IFe5D7au4mI/a<br>
uOUpCzqCYT2KnSdepzDkb2wZDuTLFvSfCgLJ0vyvW6j8xHx9lMXSoHp/Et6AQ3uH<br>
/KdnNDbBsKNv30YtFArMwVYnZ6JdJ6z4mXoP1X7aEN4q2ELgPVKKZmQ9UJZNkY32<br>
MkKksA0bSp+sVgGWW6gNqMa+I6lzr+eIClRQTeRm7T7oQ80uJyQM52Btwzhf68RQ<br>
A7LQijOi0pJUjEhy/3QAD3N9SwX0afBLuTDQaGJuBvzuuvsBPM3+u8gp4L6CrueJ<br>
Jx45dK44u2z/IsmMqifmR5eBFyNjIxlz/B9XRVXIMo1BlUrIYV2UoJ56qLIRUZQ9<br>
7fOOfZkdOZ2GLOkwVsDErKuUDXgBwFBxOrcLc6LbgahlGb8ht/nrilHzS50Pvyay<br>
n0gXz9t0oCnJLcDIzydIRvj1gEqRzYv9NPRKy4rxGKDZgwWjtAR4apDmMn/66NS6<br>
eE/7Bdd9QeCmTaZqybFHp76vs4AyCJBaGoGS4AeF3qPmr/+brCxOsXLl7C6P0mwG<br>
jxtZX8gZhsjnQsN5SqPW5WzWkN23oQd7RJk3vafam2PWr4EPkzpH+DjtdyRXIbwO<br>
NC4od03mVIg=<br>
=JyGq<br>
-----END PGP SIGNATURE-----<br>
<div>
<div><br>
_______________________________________________<br>
Lab mailing list<br>
1. subscribe <a href="http://artengine.ca/mailman/listinfo/lab" rel="noreferrer" target="_blank">
http://artengine.ca/mailman/listinfo/lab</a><br>
2. then email <a href="mailto:Lab@artengine.ca" target="_blank">Lab@artengine.ca</a> to send your message to the list<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span></div>
_______________________________________________<br>
Lab mailing list<br>
1. subscribe <a href="http://artengine.ca/mailman/listinfo/lab" rel="noreferrer" target="_blank">http://artengine.ca/mailman/listinfo/lab</a><br>
2. then email <a href="mailto:Lab@artengine.ca" target="_blank">Lab@artengine.ca</a> to send your message to the list</blockquote></div>