Subject: mailing list memberships reminder -> passwords in the clear

From: Paul Aitken <[email-masked]>
Date: Thu, 01 Nov 2012 20:20:47 +0000

Why does the "mailing list memberships reminder" send passwords in the 
clear?

For everything else I'm subscribed to, if I forget my details, one click 
sends a one-time password-reset link.
Passwords are never mailed out, and never shown.

Thanks,
P.

---

From: "John Levine" <[email-masked]>
Date: 2 Nov 2012 15:24:45 -0000

>Why does the "mailing list memberships reminder" send passwords in the 

Because that's what Mailman does.  Send code.

-- 
Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Fri, 02 Nov 2012 15:39:05 +0000

On 1 Nov 2012, at 20:20, Paul Aitken <[email-masked]> wrote:
> Why does the "mailing list memberships reminder" send passwords in the clear?

Because mailman is brain-dead stupid.  See:
http://www.jwz.org/doc/mailman.html

Sadly, and despite my best efforts to find alternative mailing list software, mailman wins on popularity (ugh) and hence support with practically no competition.  Only majordomo2, which has been unmaintained for a while now (and it's author calls it "Dead" holds much of a chance, but I doubt it would work for the IETF in its current condition.

But have hope!  The IETF serves the mailman interface over TLS, and it is an option that you can exercise *not* to have passwords mailed to you.  Go to your membership options page, and in the group containing the option to turn off the membership reminders, check the checkbox to make it global.  Later, you can have the password mailed to you on demand, or unsubscribe without needing a password at all (email confirmation loop).

> For everything else I'm subscribed to, if I forget my details, one click sends a one-time password-reset link.

Yes.  Sadly this isn't possible with mailman; you will always be mailed your password if you need it and can't remember it.

HTH.

Cheers,
Sabahattin

---

From: Mike Brescia <[email-masked]>
Date: Fri, 02 Nov 2012 12:56:21 -0400

Apparently no need to "send code".  Mailman project claims this is fixed in development version 3 (not yet released)

discussion on plain text passwords
http://mail.python.org/pipermail/mailman-users/2010-July/069844.html

project todo list
http://wiki.list.org/display/DEV/Mailman+3.0
(down under privacy, claims passwords will not be /en clair/)

---

From: "John R Levine" <[email-masked]>
Date: 2 Nov 2012 15:56:35 -0400

> And that's acceptable to the IETF? You're kidding me, right?

I can't speak for the IETF, but I do note that the same password notices 
have been going out on the first of every month for years.  You just 
noticed iit now?

And once again, if you think it should do something else, send code. 
We're volunteers here.  Assertions that it is very important for someone 
else to do work that you're not prepared to do are rarely effective.

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 2 Nov 2012 21:51:34 -0000

> Only majordomo2, which has been unmaintained for a while now (and
>it's author calls it "Dead" holds much of a chance, but I doubt it
?would work for the IETF in its current condition.

Actually, MJ2 works great, I've been using it in production for years,
but I agree that we'd need to locate a perl weenie willing to make
tweaks, and it's probably not enough better than MM to be worth the
pain of switching.

> Sadly this isn't possible with mailman; you will always be mailed
> your password if you need it and can't remember it.

If you use a high value password for your IETF list subscriptions, you
have deeper security issues than a few tweaks to mail software can fix.

R's,
John

PS: I saw a description of mailman2 by one of the developers last week.
It's really not that different, although he mentioned that the monthly
reminders are now off by default.

---

From: Warren Kumari <[email-masked]>
Date: Sat, 3 Nov 2012 09:54:38 -0400

On Nov 2, 2012, at 3:56 PM, "John R Levine" <[email-masked]> wrote:

> I can't speak for the IETF, but I do note that the same password notices have been going out on the first of every month for years.  You just noticed iit now?
> 

The mailman webUI (e.g: https://www.ietf.org/mailman/listinfo/ietf ) says:

"You may enter a privacy password below. This provides only mild security, but should prevent others from messing with your subscription. Do not use a valuable password as it will occasionally be emailed back to you in cleartext.

If you choose not to enter a password, one will be automatically generated for you, and it will be sent to you once you've confirmed your subscription. You can always request a mail-back of your password when you edit your personal options. Once a month, your password will be emailed to you as a reminder."

W

> And once again, if you think it should do something else, send code. We're volunteers here.  Assertions that it is very important for someone else to do work that you're not prepared to do are rarely effective.
> 
> R's,
> John
> 

--
Don't be impressed with unintelligible stuff said condescendingly.
    -- Radia Perlman.

---

From: Paul Aitken <[email-masked]>
Date: Fri, 02 Nov 2012 19:39:07 +0000

John,

P.

---

From: Paul Aitken <[email-masked]>
Date: Fri, 02 Nov 2012 19:39:32 +0000

Sabahattin,

Thanks for the detailed info.

I've been getting passwords mailed to me monthly for years. Someone 
pointed out the disable option just yesterday.

So I've selected the option, but that's hardly the point: the option 
should default to OFF and not be enable-able so passwords are never sent 
in the clear.

I find it hard to understand that this is acceptable to the IETF.

Thanks,
P.

---

From: Paul Aitken <[email-masked]>
Date: Fri, 02 Nov 2012 21:12:16 +0000

John,

> I can't speak for the IETF, but I do note that the same password 
> notices have been going out on the first of every month for years.  
> You just noticed iit now?

No, I've been getting the passwords for years. However I just finished a 
crypto class and really wondered what the history is here.

> We're volunteers here.  Assertions that it is very important for 
> someone else to do work that you're not prepared to do are rarely 
> effective.

It seems that this was fixed in 2007:

http://blog.tigertech.net/posts/mailman-monthly-password-reminders-not-recommended
     http://wiki.list.org/display/DEV/2007/01/13/Passwords+done+right

Thanks,
P.

---

From: Steven Bellovin <[email-masked]>
Date: Sat, 3 Nov 2012 11:34:13 -0400

> And that's acceptable to the IETF? You're kidding me, right?
Because the security is compatible with the risk.

These are open mailing lists; anyone can join, and anyone can read the
archives without subscribing.  This means that the resource being protected
is of low value -- very low value.  Sending out a randomly-generated password
in the clear is perfectly acceptable for that situation.

Having that off by default would be reasonable, but to reduce annoyance,
not because it produces any real increase in security.

For a private, sensitive mailing list, the analysis would be different.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sat, 03 Nov 2012 20:09:29 +0000

> Actually, MJ2 works great, I've been using it in production for years,

I completely agree that it's excellent software.

> tweaks, and it's probably not enough better than MM to be worth the

I think it's the difference between night and day, personally.  MJ2 is technically superior and emphasises the task of actually managing mailing lists in a very clean, black-box way.  OTOH, it seems clear that Mailman has won over all the web hosters and whatnot because it's "User-friendly".  I guess "Integrated with the web" is an adequate sell, even if it practically means "Has a simple, inflexible interface that's only accessible using a web browser from lynx up.  Certainly, the IETF could benefit from MJ2's more techie features (not least, the means to do absolutely everything by email).  Moderators, in particular.  But it still boils down to having and using supported software.

> have deeper security issues than a few tweaks to mail software can fix.

Unfortunately though, it happens quite often.  Users want all the benefits without any of the inconveniences.  So they use their easy-to-remember/crack/used-everywhere-else passwords.

Cheers,
Sabahattin

---

From: Rich Kulawiec <[email-masked]>
Date: Wed, 28 Nov 2012 11:53:09 -0500

First, an enthusiastic +1 to Steve's comments re security being
compatible with risk.

Second, Mailman is -- at this point -- easily the best available option
for mailing list management.  That is not to say it's perfect, of course
it's not -- but in terms of capability, support, development, community,
standards compliance, etc., it's the best we've got.

Third, if the data path from the IETF Mailman instance to your mail
client is compromised, then there are far more serious problems to
worry about than someone spuriously unsubscribing you or switching
you to/from digest mode or similar.

---rsk