On Thu, Dec 27, 2012 at 11:46 AM, Peter Bex <Peter.Bex@xs4all.nl> wrote:
>
> Implementing a more secure challenge-response based algorithm means
> a change in the client-server protocol. Perhaps something like SCRAM
> (maybe through SASL) really is the way forward for this, but that
> seems like quite a project and it seems to dictate how the passwords are
> stored; it requires a hash of the PBKDF2 algorithm to be stored.
It would be nonsense to do it in any other way... protecting the
password store and not the exchange would just shift the weak spot.