Programming Jabber

Plaintext authentication method

The plaintext authentication method works as you would expect and is the default lowest common denominator method supplied with the Jabber server. It is provided by the mod_auth_plain module.

Method

The password is transmitted in the XML stream, inside the <password/> tag in the jabber:iq:auth IQ-set packet, from the client to the server in plaintext, where it is compared to the password stored, also in plaintext, on the server.

When a password is changed, using a jabber:iq:register IQ-set as described earlier in this chapter, mod_auth_plain stores the password, as received, in the user’s spool file.

Advantages

This method is by far the simplest to implement on the client side. It is also useful for debugging and testing purposes as it can be used in a connection “by hand” via telnet, not requiring any extra computation such as the digest and zero-knowledge methods do.

Disadvantages

It’s insecure, on two levels. First, the password is transmitted in plaintext across the wire from client to server. The risk can be minimized by encrypting the whole connection using SSL. Second, the password is stored in plaintext on the server, which may be compromised.