MySQL password.c - sikkerheds spørgsmål

Fra MySQL manualen:

MySQL does not store passwords in plaintext form for anyone to see. Rather, the password supplied by a user who is attempting to connect is encrypted (using the PASSWORD() function). The encrypted password is then used when the client/server is checking if the password is correct. (This is done without the encrypted password ever traveling over the connection.) Note that from MySQL's point of view the encrypted password is the REAL password, so you should not give anyone access to it! In particular, don't give normal users read access to the tables in the mysql database!

Endvidere:

Do not ever give anyone (except the mysql root user) access to the user table in the mysql database! This is critical. The encrypted password is the real password in MySQL. Anyone who knows the password which is listed in the user table and has access to the host listed for the account can easily log in as that user.

Og fra en MySQL udvikler:

Well, actually, client scrambles the password with PASSWORD() and then
uses some kind of challenge-response, so no eavesdropping will help,
but reading the 'user' table is enough to login as everybody.
It is written in BIG RED LETTERS in several places in the manual,
that no user should be given access to user table exactly for this reason.

Still, there are protocols that satisfies both your conditions, and
may be MySQL authentification protocol will be strengthened in 4.0.

Man kan altså logge ind, hvis man har adgang til brugerens krypterede (PASSWORD()) password fra user tabellen.
Ved ændring af MySQL klienten, til ikke at kryptere password'et inden det sender det til serveren.

Det kræver ændring af password.c filen. Er der nogle der kan overskue hvordan denne adgangskontrol helt
præcist fungerer. Samt hvilke ændringer der er påkrævet, for at man kan logge ind med det krypterede password.

Link til password.c : htttp://www.fyrdenaf.dk/password.c