Documentation: Don't encourage unencrypted passwords for Prosody

[Bobobo-bo-Bo-bobo]

Description

The section "Secure domain" of the README.md of this project lists internal_plain as authentication method for Prosody.

This will store passwords unencrypted in the filesystem.

This is insecure (an attack could easily extract the passwords). Instead of internal_plain the method internal_hashed should be used.

The client side implementation of Jitsi Meet / Jicofo supports SCRAM as authentication method (PLAIN is obsolete and DIGEST MD5 is obsolete since 2011 - see RFC 6331 (https://tools.ietf.org/html/rfc6331)).

Upon change Prosody will convert internal_plain passwords to internal_hashed automatically (for memory and sql storage backend) when restarted.

[luixxiul]

This issue can be closed with https://github.com/jitsi/jicofo/pull/468

ref: https://community.jitsi.org/t/user-passwords-stored-in-plaintext/33099/3

[bgrozev]

I don't see any more instances of this.