jdev - 2021-10-07

ok

hm

Is my understanding correct that with the server-side credentials stored for SCRAM, you would be able to authenticate as the user?

i.e. to any service with the same hashes, salt, etc.

Ah, the RFC does cover this

(same salt is extreeeemeely unlikely ;)) ✏

That's what you think

and no, there's no CVEs coming (I hope)

But if you migrate your data using XEP-0227, the salt is preserved during the migration

So what did the RFC say? Isn't what the server keeps supposed to be be only useful for verifying an authentication attempt?

The RFC says it's not enough, but combined with observing an auth attempt from the client, it is

so it's a bit better than plaintext

"better" (assuming it remains secure forever and you never have to upgrade your hash)

Who was it? Who put 'omemo' as content type?