Fixed #24556 -- Added note about transport security to passwords documentation

[ssssam]

The 'Password management in Django' page is comprehensive on the subject
of storing passwords in the server. But was missing out a key point
about password security: traffic between client and server needs to be
encrypted when sending user's login details.

Personally, I found the existing documentation so comprehensive that I
thought 'great, someone has thought about all this for me and I don't
need to worry about password security' and forgot all about the need for
HTTPS until someone reminded me (several weeks later). So I think there
needs to be a note on this page about HTTPS.

[MarkusH]

Can you wrap password sniffing in * (italics) instead: "... vulnerable to *password sniffing*. With ..."

[ssssam]

Thanks for the detailed review! I've updated this with your comments.

[shaib]

I think the mention of HTTPS specifically is not required on a page dealing specifically with passwords. It makes sense to mention that passwords are sensitive information, and so their handling requires attention to security; at that point, I'd rather have a link to the top of topics/security, rather than the middle. XSS or insecure cookies could be just as bad as missing HTTPS.

[MarkusH]

Thinking about that change again I partially agree with @shaib. The focus of this note shouldn't be on HTTPS and only link that section, but HTTPS is the key point when it comes to password security that needs to be considered, in my opinion. I also think that a node might make more sense a bit higher on that page, e.g. right after "Password upgrading".

Suggestion: What do you think about adding something like this:

diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt
index 910d08f..d4758b2 100644
--- a/docs/topics/auth/passwords.txt
+++ b/docs/topics/auth/passwords.txt
@@ -192,6 +192,15 @@ when changing the PBKDF2 iteration count.
 .. _bcrypt: http://en.wikipedia.org/wiki/Bcrypt
 .. _`bcrypt library`: https://pypi.python.org/pypi/bcrypt/

+General security considerations
+===============================
+
+.. note::
+
+    Even though your users may use strong passwords, attackers might be able to
+    eavesdrop on their connections. You should :doc:`take your security
+    settings serious </topics/security>`, e.g. run your page over HTTPS.
+

 Manually managing a user's password
 ===================================

[MarkusH]

Since this seems to become a more complex topic than initially though, do you mind opening a ticket on Trac so we can keep track of this change.

[shaib]

s/serious/seriously/, other than that 👍

[ssssam]

@MarkusH I'm happy with what you've proposed above. I think adding 'In particular, avoid sending passwords or any other sensitive data over HTTP connections because they will be vulnerable to password sniffing.' would still be good to make it stronger.

I've opened a bug: https://code.djangoproject.com/ticket/24556

[timgraham]

Do we need a section heading and a note box? Could the section heading be put in the note box? Otherwise, looks fine to me.

[timgraham]

merged in 1119063, thanks!