[15641] in Kerberos_V5_Development
Re: prompter type question
daemon@ATHENA.MIT.EDU (Nicolas Williams)
Wed Mar 24 11:25:46 2010
Date: Wed, 24 Mar 2010 10:25:20 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Greg Hudson <ghudson@mit.edu>
Message-ID: <20100324152520.GT21244@Sun.COM>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <1269429972.7493.499.camel@ray>
Cc: MIT Kerberos Dev List <krbdev@mit.edu>,
Will Fiveash <will.fiveash@oracle.com>, "jhutz@cmu.edu" <jhutz@cmu.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, Mar 24, 2010 at 07:26:12AM -0400, Greg Hudson wrote:
> Let me explain why I'm being so picky about specific use cases. Numeric
> prompt types are a limited and poorly defined form of structured
> information. If we ask for "a PIN," we can't say what device we want
> the PIN for, which means pam_krb5 can't really return a cached PIN
> without possibly giving us one for a different device (which we know can
> be harmful due to token lockout). I do not want to create a soup of
> prompt types under different conceptions of what a prompt type means,
> only to find out later that they are inadequate for any productive
> purpose.
While that is true, the likelihood of having multiple tokens plugged in
on some seat's readers is very low. But also, your argument only
furthers the argument for adding more prompt metadata.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
