Programming Jabber

Passwords

You may be wondering about the plaintext nature of the password sent in the registration process. Although the Jabber server offers different types of password-based authentication, there’s a “bootstrap” process required to get the password to the server in the first place. There’s currently no way around the fact that the server must at one time receive the password in all its plaintext glory. After receiving it, there are authentication processes that don’t use the plaintext password again.

So if you’re concerned about the security of this registration phase, consider doing it over a secure (SSL) connection to the server.

We will look at the detail of the different authentication mechanisms later in this chapter; however, it is worth noting here, in the context of the registration process, that the JSM modules that implement the mechanism are responsible for storing the password when it’s received. The mod_register module actually registers the user, but it is the mod_auth_plain and mod_auth_0k modules that actually store the password when received.^[3]

Passwords are stored on another occasion—when a user wishes to change his password. This procedure is also covered by the jabber:iq:register namespace, albeit in a different context—the context of a session. While a jabber:iq:register-based IQ conversation outside the context of a session is for registering a user, a similar conversation within the context of a session, that is, after a user has authenticated, ...