[standards-jig] auth & reg redux

Robert Norris rob at cataclysm.cx
Sun Jun 1 23:56:59 UTC 2003


> I know that we have SASL to replace auth, but is there something in the 
> pipeline to replace register? Also, register is probably secure enough 
> *if* you're using TLS. :)

I've seen the SASL PLAIN mechanism used for in-band registration before
(and Cyrus SASL even has an option to enable this). The server offers
PLAIN over a protected (TLS) channel, and then stores the credentials
presented by the client. Next time, the client takes DIGEST-MD5 or some
such.

Its not as rich as iq:register (can't require other fields like email
and such), but its worth thinking about.

Rob.

-- 
Robert Norris                                       GPG: 1024D/FC18E6C2
Email+Jabber: rob at cataclysm.cx                Web: http://cataclysm.cx/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://mail.jabber.org/pipermail/standards/attachments/20030602/4182c920/attachment.sig>


More information about the Standards mailing list