NEWS: adjust note about ServerAuthentication handlers
NEWS: adjust note about ServerAuthentication handlers

rishi pointed out on IRC that ServerAuthentication still makes
passwords available to eavesdroppers on the session bus (if LOGIN,
PLAIN or X-TELEPATHY-PASSWORD are used). ServerAuthentication doesn't
allow arbitrary applications to ask MC "what is the password for
account X?", which is what I was thinking of.

The session bus is not generally modelled to be a security
boundary; if yours is, you will need to write a security policy,
then ensure that that policy is applied. Telepathy components are not
designed to be used unmodified on an untrusted session bus. (Starting
points include turning off eavesdropping, applying a "default-deny"
policy, preventing processes other than Mission Control from
calling HandleChannels on your ServerAuthentication client, and
preventing processes from subverting each other with ptrace.)

freedesktop-unofficial-mirror/telepathy__telepathy-mission-control,freedesktop-unofficial-mirror/telepathy__telepathy-mission-control,freedesktop-unofficial-mirror/telepathy__telepathy-mission-control,freedesktop-unofficial-mirror/telepathy__telepathy-mission-control