From: isca@umaxa.weeg.uiowa.edu (Iowa Student Computer Association)
Subject: Re: Scripting and passwords
Organization: University of Iowa, Iowa City, IA, USA
Date: Wed, 19 Aug 1992 18:29:31 GMT

In article <1992Aug19.165301.17332@news.uiowa.edu> jones@pyrite.cs.uiowa.edu 
	(Douglas W. Jones) writes:
>You mean to say that, if by coincidence, the string I type in response to a
>prompt happens to be the same as the string I use as a password, things will
>bomb?  This won't be very pleasant for users who happen to have poorly chosen
>passwords.  For years, for example, my password was "tree" (yep, 4 letters,
>lower case only, all among the 10 most common letters in English text).
>

That's exactly what this means.  You would then be barred from ever entering
tree for any prompt.  Aside from a good incentive to pick a weird password,
there are other reasons I'll talk about below.

>   The interpreter shouldn't know my password.  Decent security systems limit
>   the use of passwords as much as possible, both outside the system and
>   inside.  Ideally, the client code (where the interpreter seems to run)
>   shouldn't know the password, it should only know that the user has already
>   been authenticated.  Only the authentication gateway should ever see the
>   password!

In Bamboo (the authentication system under work for Panda) the client knows
the user's master password, since in many cases the client itself is the
authentication server.  At any rate, on any system where you log in with a
password to something, the client is *always* going to get your password.
This is just a case of hanging onto it.  Or you could encrypt every string
typed in by the user and compare to the entry in /etc/passwd, for those
systems with a world-readable passwd.

>There is a complementary side to this:
>
>   Users must be aware that, every time they are asked for a password, there
>   is a possibility that they are being asked by a trojan horse.  Ideally,
>   users should know that they are never going to need to present a password
>   other than at well-known points in the dialog, such as at the very start,
>   when they are asked to log in or as part of the dialog used to change an
>   old password.  If the user sees a password request at any other time, the
>   user should assume that something is wrong and terminate the session
>   immediately.

As we get more and more away from users of systems that work with computer
security and more into the "normal people" user base, we will find that it
will be *impossible* to get all users to understand this.  We can yell and
scream and throw big notices up all over the place (which are very distracting
after the user gets the point, at best) and you will still have a not 
insignificant portion of the user base who will fall for the "Connection
lost.  Please enter password to re-establish connection" trick.

>The Unix logout/login sequence can still be faked by a trojan horse, though,
>so I prefer the model used by the Illinois Plato system, where the standard
>way to get a login prompt was to kill your session with a keystroke
>sequence that was guaranteed to terminate any running applications in either
>the Plato Programmable Terminal or on the mainframe.
>

Better yet, the case where a user uses a local machine (like a desktop Mac)
as a client, so that the password never has to go out over the net.  Then 
you just have to make sure that the client on the Mac hasn't been tampered
with....

Basically, it was felt that two things were needed: 1) scripts, in order to
be very powerful at all, need to be able to ask the user questions, so a
"read" primitive of some sort is needed; and 2) people shouldn't be able to
write a program to fake a user into giving a password.  Since someone will 
always fall for the request, it was felt that banning passwords was a 
reasonable step.

Feel free to take that restriction out of your users' client if you feel that
they know enough never to fall for that old trick.

And of course, the reason why I posted is that we're open for any
suggestions...  I can only imagine the folks at the CIC conference are all
holding up big "Hairball" signs right now, and we'd welcome a less... well,
hairy solution.

-- Lee Brintle