Yes, I've been mulling that over for a while too... how do we deal with existing
passwords that are plaintext? Something a-la LDAP: '{MD5}blahblahblah',
'{SHA1}blahblahblah', and so on?

Please pay attention to portability. Please don't use MD5, use at least SHA-1. 
Please
use some salting to prevent attacks using rainbow tables.

There seems to have some misunderstanding regarding my comment above. It is not
intended personal in any way. They're just technical issues I'd like the
implementation to address.

SHA-1 is fine... my question was about whether to indicate the hash method used 
so
that we can support existing plaintext values. It also, of course allows 
multiple
hash mechanisms to be supported on different platforms.

I have no strong opinions whatsoever on this... just thinking out loud as I had 
been
thinking about this the other day.

I think it's fine if we leave it to the platform what hash implementation to 
use.
Smalltalk images are not portable and I don't think we'll ever have to compare 
a hash
value generated on an other platform *famous last words*.

Even if we can probably sell it as a security feature ;-)

I think it is fine if the protocol for setting the password stays the same. It 
is not necessary that existing instances 
of WAApplication are portable. Usually a new version of Seaside means that you 
re-register your apps (and reset 
the passwords) anyway.

See Seaside-Squeak-Core-jf.49 and Seaside-Core-jf.163

Do we record the protocol of the platform classes somewhere so porters know 
what they
need to implement?

Also, how does everyone feel about empty passwords being allowed. The default
implementation allows them, which I think is ok, but if anyone feels strongly 
it can
easily be changed.

I also considered using #passwordHash as the configuration key to be more 
accurate
but thought I'd keep the first commit as simple as possible. I'll happily 
change it
if others agree.

If we're that serious about it and go to such lengths I think doesn't make 
sense to
accept empty passwords.

Ok, I'll add a check for empty passwords during authentication.

I still wonder if I need to make a note of the addition to the platform class
somewhere...

And what about #password vs. #passwordHash ? I think I'll change it to 
#passwordHash
unless anyone objects. I can't see any real plus to keeping it as it was so I'd
rather be accurate.

Regarding a note about the addition: yes.
The best is to add a test to WAPlatformTest.

Test added.
Empty password check added.
Attribute renamed to #passwordHash.

Seaside-Core-jf.168
Seaside-Squeak-Core-jf.49
Seaside-Tests-jf.131