I need to set users up for subversion access, and we're currently stuck using
htpasswd for our credential storage. If a user sends me an
htpasswd record via email (or GChat / off the record?), what's the level of risk we're incurring?
Hashing would be done using the default
htpasswd -n someuser
And some users would likely be generating their hashes with this tool: http://www.htaccesstools.com/htpasswd-generator/
So, there are three risks I'd like a professional opinion on. The risk or likelihood that ...
- .. htaccesstools and/or the connection between the two is compromised and that the attacker can guess what the credentials will actually be used for!
- .. the IM/email will be compromised.
- .. if the hash is known, that it can be cracked. (If we can assume the users pick strong passwords, what level of risk does htpasswd's default hashing (md5?) impose?)
But maybe more importantly, would a security-minded professional in my situation prefer this route? Or would he just pick passwords and tell the end-users their passwords over the phone?