XMPP Service Operators - 2022-02-15

This "postfix+dovecot" tangent reminds of https://www.justinbuchanan.com/blog/posts/Application-Specific-Passwords-for-Dovecot-and-Postfix Anyone doing the "application-specific passwords" thing with your XMPP service?

rozzin: Dovecot supports SCRAM: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/ Cyrus SASL supports SCRAM: https://www.cyrusimap.org/sasl/sasl/authentication_mechanisms.html Postfix with Dovecot or Cyrus SASL too, more informations here: https://github.com/scram-sasl/info/issues/1

what does SCRAM have to do with this

> https://www.justinbuchanan.com/blog/posts/Application-Specific-Passwords-for-Dovecot-and-Postfix I find the threat model dumb, wtf ✏

Licaon_Kter: yeah, I agree that this sounds pretty dumb: > I always hate the feeling of using any of my username and password combinations on sketchy public computer somewhere. You know the kind I am talking about, those computers at hotels running Windows XP and IE6, signed as "Adminstrator", with every toolbar and add-on installed from a 9 year old version of Real Player to three different versions of some Internet poker game. There's bound to be a key logger in there someplace. > One time use passwords have been around for a long time to mitigate this type of scenario.

Licaon_Kter: but he goes someplace interesting/useful even if he started the journey for the wrong reasons.

Yeah...maybe...it feels like a solution in search of a problem

Just pretend that he said something like "it's going to be annoying resetting the password in every client program on every device I use if ever my smartphone is stolen" or whatever other reason sounds more reasonable to you.

Certificate-based login also serves the same sort of purposes, I guess....

Licaon_Kter, in 2012 it wasn’t as common to have a smartphone I think.

Even more recently, I’ve had to use one such computer.

Thankfully I hadn’t restricted all of my servers to certificates, or else I wouldn’t have been able to contact the person I had to contact.

Link Mauve: they say phone and typing on it, that confuses me

I only read the quote rozzin pasted.