> The password should be non-reversably encrypted in the cookie if > it's there at all. But since Ipswitch doesn't understand how to > non-reversably encrypt a password, I don't think you'll be seeing > this feature.
That's bit FUDdy. A cardinal rule of cryptography is that encryption that requires interpretation and/or decryption without user intervention is naturally insecure. Performing non-reversible encryption on a password, then accepting the encrypted form for authentication without user intervention (as must be the case when using cookie-based password persistence), is far from impressive security. True, it will prohibit someone with root access from reversing the password and using it to authenticate against other servers if -- as indeed is common -- the same password is used for multiple apps. But, in essence, encrypting the password in a cookie is largely marketing to paranoid end-users who don't think things through technically. This doesn't mean it isn't a worthwhile feature, as customer relations are always important. But on a technical level, it's pretty meek. As you suggest, not persisting the password locally _at all_ is a better solution. I think the existing checkboxes are pretty self-explanatory in that regard. --Sandy ------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
