Open Stack

On Dec 19, 2012, at 10:19 AM, Brian Lamar <brian.lamar at rackspace.com> wrote:

> 
> I personally think the admin password implementation is "secure enough". All data should be accessed through SSL and the password is currently never stored. I don't think we should ever endeavor to store the admin password, no matter how secure it might seem. I like that right now it's sent to the agent and the user once and then lost into the ether.

The problem with the current implementation is that it requires a secure channel into the guest. Also, giving the user the password only once requires some way to reset it in case they lose it, which makes the channel even harder to secure.

Vish