From 4bb8301142bf5654e7ef724f115b921f607dcc7c Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Wed, 17 Sep 2014 00:08:30 +0200 Subject: [PATCH] docs: explain why we auto-generate random update passwords --- docs/security.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/security.rst b/docs/security.rst index 1c48345..55b585c 100644 --- a/docs/security.rst +++ b/docs/security.rst @@ -85,6 +85,11 @@ It is not stored in clear text by nsupdate.info. If you lose the secret, you'll have to generate a new one and change it in your update client also. +We use a random and automatically generated update secret to avoid that users +enter a bad password here (like reusing a password they use somewhere else, +choosing a too simple password) and to avoid disclosure of such user-chosen +passwords in case the hashes ever get stolen and brute forced. + Nameserver Update Secret (backend, RFC 2136) --------------------------------------------