----- Original Message -----
On Wed, 20 Mar 2013 07:19:27 +0100
Pierre-Yves Chibon <pingou(a)pingoured.fr> wrote:
> On Wed, 2013-03-20 at 02:13 -0400, seth vidal wrote:
> > On Tue, 12 Mar 2013 08:10:21 +0100
> > Pierre-Yves Chibon <pingou(a)pingoured.fr> wrote:
> >
> > > On Tue, 2013-03-12 at 03:07 -0400, Bohuslav Kabrda wrote:
> > > > A question for this series. If I understand it correctly, the
> > > > api_login is just another random generated string, right?
> > > > Would
> > > > you please elaborate a bit more on why having separate logins
> > > > is good?
> > >
> > > Yes it is, (with the addition that that the part before '##' is
> > > a
> > > based64 of 'copr').
> > > I think the basic idea here is to reduce even more the
> > > possibility of brute force since one would have to do it for
> > > both
> > > the api token and the username. Seth, do you see another
> > > interest
> > > for it?
> > >
> > > It also seems to be the approach taken by cloud plateform and
> > > by
> > > oauth system (if my understanding is correct).
> > >
> >
> > That's correct. I think the idea is that if someone discovers
> > your
> > token they don't discover who owns it but if we find someone
> > using
> > that token username somewhere else - we can trace back what app
> > it
> > came from.
>
> Then I'm wondering if it's interesting to have the base64 of 'copr'
> in
> the token itself.
> In a way I think, no otherwise if someone finds your token it can
> find
> out where to use it. On the other side, we already save the token
> in a
> rather explicit place ~/.config/copr so in that respect it doesn't
> really matter.
>
yah - I'm not really sure. I'd rather plan for the case where we need
to figure out where something is from and less for trying to hide it
from a theoretical attacker.
So encoding copr in there helps us.
If the attacker can figure it out well, then - that's fine - but I
just
want to know we can, too.
-sv
Thanks for the explanation guys, now I'm finally +1 for the commit :) Please go on and
commit.
Slavek.
--
Regards,
Bohuslav "Slavek" Kabrda.