Quoth Terri Oda <terri@zone12.com>: | On Wed, Nov 20, 2002 at 03:10:29PM -0500, Stonewall Ballard wrote: ... |> Nobody on any of the lists I run would have a clue on how to use this.
| And to contrast, I've not only had people request this sort of thing, or | express surprise that there is no secure way to do passwords, but I've also | gotten mail from one user had some, um, choice words for the list | administrators when she discovered that her password was sent in plaintext.
I think at our site, most fall into both categories. They're generally not interested in computing technology of this kind and you can't make them understand something they won't think about. But we've worked hard enough to make them conscious of a password security issue here - I mean, they will sense an incongruity.
As do we. Mailman is one of the few, if not the only, application at our site that uses passwords, and we had to make a case for it. Part of the deal is that we avoid password authentication for our own site local users, so they (we hope) will not be tempted to set their Mailman password the same as their site (Kerberos) password. Instead they use their Kerberos password to authenticate to the site web authentication service, whereupon they're authenticated automatically to Mailman (as their Kerberos principal, which I map to mailman ID.) That's our fig leaf.
Donn Cave, donn@u.washington.edu