Hi Daniel Maybe I can bounce this back at you in the form of another question...who does this password belong to that you don't want to disturb? It sounds like you don't know who has access to this data. This has been one of the issues with the MNTNER object since it's inception. It is a bucket full of anonymous security tokens. Personalised auth won't help much with this until all auth is moved into PERSON objects. cheers denis On 20/08/2015 13:43, Daniel Stolpe wrote:
I just had a very specific experience but this is a general problem.
What I wanted to do was update a maintainer object in the database. No problems since I was authorized via a PGP key. The problem was that one of the lines looked like:
auth: MD5-PW # Filtered
And although I have no personal use for the md5 hash I did not want to disturb users who might have. I asked the NCC for advice and the answers were like "if you have an access account" (yes) you can add a line "auth: SSO xxxx@xxxx.xx" (yes). Still not a solution to my problem since adding the SSO line would just break the md5 anyway.
The solution this time was that I eventually found a local copy of the object with the md5 hash unfiltered.
I know the md5 hashes are a security problem and I do not recommend anyone using them but as long as they are there the filtering causes trouble. And by the way, we now see a lot of
auth: SSO # Filtered
What I am looking for is a way to retrieve the whole unfiltered object for anyone authorized, or, at least, a possibility to updated the object without touching the filtered lines.
Maybe you could send a PGP signed request, not for updating but just for viewing the complete object?
Best Regards,
Daniel Stolpe
_________________________________________________________________________________
Daniel Stolpe Tel: 08 - 688 11 81 stolpe@resilans.se Resilans AB Fax: 08 - 55 00 21 63 http://www.resilans.se/ Box 45 094 556741-1193 104 30 Stockholm