Mailing-List: contact user-help@cassandra.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cassandra.apache.org
Received-SPF: pass (athena.apache.org: domain of
 gcdcu-cassandra-user-1@m.gmane.org designates 80.91.229.12 as permitted
 sender)
To: user@cassandra.apache.org
From: Ted Zlatanov <tzz@lifelogs.com>
Subject: Re: Questions about using MD5 encryption with SimpleAuthenticator
Date: Wed, 18 May 2011 08:19:25 -0500
Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @
 Cienfuegos
Lines: 22
Message-ID: <87r57wrvs2.fsf@lifelogs.com>
References: <BANLkTikW5VuSLjSvShe24+puA-YncHLqvQ@mail.gmail.com>
	<BANLkTikHR-ZbuegNCnitpX4mVfCBkQ_rjQ@mail.gmail.com>
	<74770DAE-665B-41D4-8A76-3FBD1BA0A27C@thelastpickle.com>
	<BANLkTinfJ3XCxy1SfuBEYrxU9QsQR_PD9w@mail.gmail.com>
	<BANLkTimzwPnSObwyTitm-ntGs9AwYn-08Q@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain
User-Agent: Gnus/5.110018 (No Gnus v0.18) Emacs/24.0.50 (gnu/linux)
Cancel-Lock: sha1:cKsKn8QFP07JjXMR48SVXtXxuMM=

On Tue, 17 May 2011 15:52:22 -0700 Sameer Farooqui <cassandralabs@gmail.com> wrote: 

SF> Would still be nice though to use the bcrypt hash over MD5 for stronger
SF> security.

I used MD5 when I proposed SimpleAuthenticator for two reasons:

1) SimpleAuthenticator is supposed to be a demo of the authentication
interface.  It can be used for testing and trivial setups, but I
wouldn't use it in production.  So it's meant to get you going easily,
not to serve you long-term.

2) MD5 is built into Java.  At the time, bcrypt and SHA-* were not.  I
used MD5 only so the passwords are not stored in the clear, not to
provide production-level security.

You should consider carefully the implications of storing passwords in a
file on a database server, no matter how they are encrypted.  It would
be better to write a trivial AD/LDAP/etc. authenticator that fits your
specific needs and doesn't rely on a local file.

Ted