I donno Rich...a couple of decades ago I lost my Slashdot account because someone was able to access it. I used the password in two places...Slashdot and all the blasted mailman instances I was signed up with. To this day, I still use the same password on all my mailman subscriptions because I consider mailman insecure for emailing out passwords. I just obviously don't use the password anywhere else. So you're right that all anyone can do is unsubscribe me from something...which isn't a big deal, but it makes me wonder just how many people have terrible mailman passwords and maybe use them elsewhere...and wouldn't report a compromise because...well...it'd make me look stupid. 😉 Ignoring all of that—it's just a horrible practice to not encrypt passwords and to email them out. You don't really even need a mailman password. You just put in your email address and hit 'unsubscribe'...and it'll send you a link to click as authorization...so why not drop passwords altogether and just reply on click-to-authorize? Or just encrypt the passwords and have a "forgot password" click-to-reset like every other app on the planet? -A On Sat Sep 2, 2023, 07:57 AM GMT, Rich Kulawiec <mailto:rsk@gsp.org> wrote:
On Fri, Sep 01, 2023 at 10:16:05AM -0700, Randy Bush wrote:
and i just have to wonder about sending passords over the net in cleartext in 2023. really?
This is a non-issue.
Given that pretty much every SMTP connection is encrypted and that the worst thing that an attacker in possession of one of your Mailman passwords can do is unsubscribe you (in which case you and the list manager will be notified, and you can solve the problem quite rapidly), no, this isn't a problem that anyone needs to worry about.
I've run (and am running) a lot of mailing lists with Mailman including some large-ish ones for what's now approaching 20 years. The scenario above has never happened. Nobody's even tried, which isn't surprising given that such an attack is increasingly difficult and yields little, if any, benefit to the attacker. Moreover, any hypothetical attacker possessing the resources and expertise required to pull this off could certainly find far more effective things to do.
---rsk