Details
-
Improvement
-
Status: Open
-
Major
-
Resolution: Unresolved
-
None
-
None
-
None
Description
password storage is in clear text. if there was a compromise, there would be a clear text map of entities:password ... for example, in the org.apache.vysper.xmpp.server.ServerMain class:
accountManagement.addUser("user1@vysper.org", "password1");
Tracing the addUser method the "password" is never encrypted for storage.