#15 encrypt user passwords

[Free Beachler]

ecrypt user passwords in DB. under no circumstance
should it be easy enough for a DBA (or attacker) to
simply gain access to the SQL/mySQL data store for
hmailserver and be able to view a user password in clear
text. storing clear text passwords compromises
application integrity because it means any DBA,
Administrator, or attacker can easily feign a user in the
system - making it easy even for authorized users to
abuse their power.

even with encrypted passwords in the DB the application
would be vulnerable to:
1) sniffing attacks - this is inherent to SMTP/POP and
nothing can be done about this
2) code-based attacks - since the code is open source
this just means reverse engineering the encryption
algorithm.

however, #2 can be alieviated by the consumer because
they can re-compile source (if available here) with a
new key and even if they want they can "throw away"
the source w/key...this would mean that code-based
attacks would have to be carried out by de-compiling
the EXE/DLL files and reverse-engineering, clearly more
painful.

-f

[Nobody/Anonymous]

Logged In: NO

Does the encryption need to reversable? Couldn't something
like an MD5 hashed p/w be stored in the DB... MSN uses this
quite effectively (about the ONLY thing it does effectively) :)

Great work btw, guys. We've been having problems @ the
office w/ our ISP's SMTP server. Found this about an hour
ago, installed it on our DC and already reconfigured all the
workstations.. works like a dream!

Keep it up.