Skip to content

Instantly share code, notes, and snippets.

View mohsenasm's full-sized avatar
🏠
Working from home

Mohammad-Mohsen Aseman-Manzar mohsenasm

🏠
Working from home
View GitHub Profile
@slingamn
slingamn / against_scram.md
Created August 13, 2021 01:15
Against SCRAM

Against SCRAM

I added support for the SCRAM-SHA-256 authentication mechanism to the Ergo IRC server, in response to demand for a reference implementation that clients could test against. Conversely, if you're implementing a server, I added an irctest server test covering it.

Nonetheless, this decision should not be taken as an endorsement of SCRAM. I recommend against implementing SCRAM-SHA-256 or any other SCRAM variant. Here's why.

The baseline: SASL PLAIN over TLS