<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi Thomas,<br>
<br>
<div class="moz-cite-prefix">On 27.11.2015 11:05, Thomas Raehalme
wrote:<br>
</div>
<blockquote
cite="mid:CAPyAMoZZEojM9+dn5qw=9xLNzRRLJs02Yn8f9wwLVU5Z9==L=w@mail.gmail.com"
type="cite">
<div dir="ltr">Hi!
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Nov 27, 2015 at 11:23 AM,
Vlastimil Elias <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:velias@redhat.com"
target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:velias@redhat.com">velias@redhat.com</a></a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">2.
remove validation of current password (remove "Password"
field). Two<br>
reasons for this:<br>
- security impact of this check is small. If attacker
is able to<br>
compromise Account app then he can always change email and
then use<br>
"Forgot password" feature to change password<br>
- user created over Identity Provider do not know old
password<br>
(because it is not set) so he is not able to set password
using this screen<br>
After we implement support for reauthentication
(KEYCLOAK-2076) then we<br>
should set some reasonable reauth timeout for Account app
instead, this<br>
will make it more secure at all.<br>
</blockquote>
<div><br>
</div>
<div>Wouldn't it make more sense to add password validation
when changing email?</div>
</div>
</div>
</div>
</blockquote>
<br>
Yes, this is why I write about use of general reauthentication
mechanism as defined in KEYCLOAK-2076 for whole Account app.<br>
It will work even for other authentication types - some keycloak
instances may be configured not to use passwords at all.<br>
<br>
Vl<br>
<br>
<blockquote
cite="mid:CAPyAMoZZEojM9+dn5qw=9xLNzRRLJs02Yn8f9wwLVU5Z9==L=w@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div><br>
</div>
<div>Best regards,</div>
<div>Thomas</div>
</div>
</div>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Vlastimil Elias
Principal Software Engineer
Developer Portal Engineering Team</pre>
</body>
</html>