DomainKey-Signature: a=rsa-sha1; c=nofws;        d=gmail.com; s=gamma;        h=mime-version:in-reply-to:references:date:message-id:subject:from:to         :cc:content-type;        b=e6wLhsk0B5WK/Bk5Wnhu2Ix8uVMg4kXsWWZ4MTD0Ya2ZeeG4ExtgXYRvyJnge8SBZs         MOoTZAKz3TLDPqnB6C+gO7RLoKxDyNaW4FiQ3DnbC1MQuOL9zDdKt5F0DwrONeGn7El7         I3hBoObEbpumJ/sSVxZLCIuAuMQQMqSyh3A2M=
MIME-Version: 1.0
In-Reply-To: <BLU129-W102D024FE580F9CF4A00A3D8C10@phx.gbl>
References: <000c01cbd81a$9b36cbc0$130210ac@CPU002019>	<0EC85B1F3B2DF8409BF66DC182F495D9858CAB@DEEDS.pti-nps.com>	<001301cbd824$becf4cb0$130210ac@CPU002019>	<BLU129-W1571CE8F3FA9994118683FD8C10@phx.gbl>	<BLU129-W102D024FE580F9CF4A00A3D8C10@phx.gbl>
Date: Thu, 3 Mar 2011 13:15:37 +0100
Message-ID: <AANLkTik_FsPeSynMMOS3_Kz-X7H-gKZ0nsWjeMaim=cz@mail.gmail.com>
Subject: Re: Clear text credentials?
From: Andre van Winssen <dreveewee@gmail.com>
To: nupendra@hotmail.com
Cc: oracle-l@freelists.org
Content-Type: multipart/alternative; boundary=90e6ba30956ebc24f7049d92fc0e
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: dreveewee@gmail.com
--90e6ba30956ebc24f7049d92fc0e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi Upendra,
if what you mean with your last question is a toned down oracle software
solution =E0 la ASO then the answer is NO. But there are other ways to
accomplish the same, i.e. protection from network sniffing and intercepting=
.
To name just three:
ssh tunneling, ipsec (network layer - layer 3 in OSI) or even encrypting
network cards. You would have to investigate which option suits you best.

Kind regards,
Andre

2011/3/1 Upendra N <nupendra@hotmail.com>

> I found this documentation which confirms that 10g onwards client is
> encrypting the passwords:
>
> http://download.oracle.com/docs/cd/B19306_01/win.102/b14304/admin.htm#sth=
ref294
>
> My other question still stays open.. is there a toned down version of ASO
> (40 or 56-bit) encryption available for free?
> Thanks
> -Upendra
>
>
>
> ------------------------------
> From: nupendra@hotmail.com
> To: oracle-l@freelists.org
> Subject: Clear text credentials?
> Date: Tue, 1 Mar 2011 14:38:26 -0500
>
>
> Hello guys,
> Question..
> When someone connects from Host_A to Host_B and if the communication is n=
ot
> encrypted using Advanced Security Option (ASO) or a similar mechanism, wo=
uld
> the user credentials be sent in Clear Text? If so, is there a way to secu=
re
> it? The requirement is to protect the username/password without using
> ASO/SSH Tunnel.
>
> If my memory serves correctly, a lower version of ASO (40 or 56-bit)
> encryption is available for free? Is that true?
>
> Your feedback is appreciated.
> Thanks
> -Upendra
>
>

--90e6ba30956ebc24f7049d92fc0e
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>Hi Upendra,</div>
<div>if what you mean with your last question is a toned down oracle softwa=
re solution =E0 la ASO then the answer is NO. But there are other ways to a=
ccomplish the same, i.e. protection from network sniffing and intercepting.=
 To name just three:</div>

<div>ssh tunneling, ipsec (network layer - layer 3 in OSI) or even encrypti=
ng network cards. You would have to investigate which option suits you best=
.</div>
<div>=A0</div>
<div>Kind regards,</div>
<div>Andre<br><br></div>
<div class=3D"gmail_quote">2011/3/1 Upendra N <span dir=3D"ltr">&lt;<a href=
=3D"mailto:nupendra@hotmail.com">nupendra@hotmail.com</a>&gt;</span><br>
<blockquote style=3D"BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex=
; PADDING-LEFT: 1ex" class=3D"gmail_quote">
<div>I found this documentation which confirms that 10g onwards client is e=
ncrypting the passwords:<br><a href=3D"http://download.oracle.com/docs/cd/B=
19306_01/win.102/b14304/admin.htm#sthref294" target=3D"_blank">http://downl=
oad.oracle.com/docs/cd/B19306_01/win.102/b14304/admin.htm#sthref294</a><br>
<br>My other question still stays open.. is there a toned down version of A=
SO (40 or 56-bit) encryption available for free?<br>Thanks<br><font color=
=3D"#888888">-Upendra<br></font>
<div class=3D"hm"><br><br><br>
<hr>
From: <a href=3D"mailto:nupendra@hotmail.com" target=3D"_blank">nupendra@ho=
tmail.com</a><br>To: <a href=3D"mailto:oracle-l@freelists.org" target=3D"_b=
lank">oracle-l@freelists.org</a><br>Subject: Clear text credentials?<br>Dat=
e: Tue, 1 Mar 2011 14:38:26 -0500</div>

<div>
<div></div>
<div class=3D"h5"><br><br>Hello guys,<br>Question..<br>When someone connect=
s from Host_A to Host_B and if the communication is not encrypted using Adv=
anced Security Option (ASO) or a similar mechanism, would the user credenti=
als be sent in Clear Text? If so, is there a way to secure it? The requirem=
ent is to protect the username/password without using ASO/SSH Tunnel. <br>
<br>If my memory serves correctly, a lower version of ASO (40 or 56-bit) en=
cryption is available for free? Is that true?<br><br>Your feedback is appre=
ciated.<br>Thanks <br>-Upendra<br><br></div></div></div></blockquote></div>
<br>

--90e6ba30956ebc24f7049d92fc0e--
--
http://www.freelists.org/webpage/oracle-l