Comment 74 for bug 24220

Revision history for this message
In , Nelson-bolyard (nelson-bolyard) wrote :

I think the problem is with the phrase "use secure authentication".
The pref that bears that label enables a class of algorithms that use
keyed hashes as a challenge-response protocol. It enables specific
algorithms, but the dumbed-down description is overly broad, so that
users tend to imagine that it includes SSL. It specifies that they are
to be used to the exclusion of "plain text" passwords.

Boris, you seem to be arguing that the pref should be changed to match
the label, rather than the label changed to match the pref.
I think your proposal is equivalent to saying that the pref should mean
"disable the use of plain text password over unencrypted channels".