[db-wg] Plain text passwords in email updates

Dear Colleagues,

The RIPE NCC recently announced completion of an action point from the
RIPE Database Working Group to hide the password hashes in MNTNER
objects from public view. As a follow up to that, we agreed to contact
all maintainers and advise them to update their passwords. This was also
completed last week. At RIPE 64 we will provide some statistics on the
outcome of that advice.

The next issue that was raised in the Database Working group session at
RIPE 63 was the use of plain text passwords in emails to update data in
the RIPE Database. The RIPE NCC would like to invite members of the
community to put forward and discuss ideas on resolving this matter.

Note that there are now many ways to update objects in the RIPE
Database. As well as the traditional email service, there is also
Webupdates for single or small numbers of objects to be updated. For
scripting of automated updates, there are Syncupdates and the RESTful API.

Some ideas that have been suggested during discussions in the past are
to disallow the use of passwords in email updates and also the option to
drop email updates completely. There may also be other options.

As usual, the RIPE NCC will follow any discussions and provide technical
input where necessary.

Regards,

Denis Walker
Business Analyst
RIPE NCC Database Group