1Why does CyrusSasl store plaintext passwords in its databases? 2-------------------------------------------------------------- 3 4To operate with the CRAM-MD5, DIGEST-MD5 and SCRAM mechanisms, Cyrus SASL 5stores plaintext versions of the passwords in its secret database (an 6AuxpropPlugin). 7 8This is typically regarded as insecure practice, however the alternative 9is not much better. For CRAM-MD5, DIGEST-MD5 and SCRAM to function, they must 10have a plaintext equivalent locally in order to confirm the hash that 11actually goes across a wire. This, if these equivalents were 12compromised, it is trivially easy for an attacker to have access to any 13account on the system. 14 15Note that for DIGEST-MD5 this isn't strictly true: the hash that DIGEST 16can use limits the attack to only the realm for which the password 17applies, but this is a questionable security gain for the increased 18management hassles (you can't share them between mechanisms) that the 19plaintext equivalents cause. 20 21