Re: suggestion: Argon2id example in `doveadm pw` examples
On 02/08/2025 10:31 PM MST Sean McBride via dovecot <dovecot@dovecot.org> wrote:
It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so...
Best practice these days is to file a bug report (or MR) to GitHub.
https://github.com/dovecot/ shows the various Dovecot components.
We are actively working on improving our various websites, so this updated recommendation will (eventually) work its way on the pages somewhere.
The docs here are very good:
https://doc.dovecot.org/main/core/man/doveadm-pw.1.html
but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to:
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet....
So it would be nice to have an example corresponding to best practices, showing use of argon2id.
I could attempt a PR on GitHub if you'd like.
That would be the proper way to suggest.
Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.)
michael
On 12 Feb 2025, at 13:52, Michael Slusarz wrote:
It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so...
Best practice these days is to file a bug report (or MR) to GitHub.
I guess that web page needs updating too then. :)
Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.)
I take your point, but if you're going to give an example (there are 2 given already), why not at least have the example use the best practices? Phrased alternatively, why is it better that the example uses MD5 instead of Argon?
Here's my PR: https://github.com/dovecot/documentation/pull/1172
Sean
On 13/02/2025 19:30 EET Sean McBride via dovecot <dovecot@dovecot.org> wrote: On 12 Feb 2025, at 13:52, Michael Slusarz wrote: >> It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... > Best practice these days is to file a bug report (or MR) to GitHub. I guess that web page needs updating too then. :) Do note: as mentioned in another message to the list I just sent, the mission of the Dovecot documentation is to document how the software works. It is not to document email server hosting best practices. Determination of which PW hashing algorithm to use seems to be in the latter category. (Documenting that Dovecot supports argon2id is in scope per the former, but it sounds like we did our job there.) I take your point, but if you're going to give an example (there are 2 given already), why not at least have the example use the best practices? Phrased alternatively, why is it better that the example uses MD5 instead of Argon? Here's my PR: https://github.com/dovecot/documentation/pull/1172 Sean _______________________________________________ dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-leave@dovecot.org Also as generic note that ARGON2 is usually not very good choice as it tends to use much memory and CPU (as intended), making it not ideal for systems that are constantly logging in & out. At least you need to tune down the effirt factor so it is fast enough. Aki
participants (3)
-
Aki Tuomi
-
Michael Slusarz
-
Sean McBride