Saved Pandora credentials
=========================

With this scheme, a user may set their Pandora credentials in pianod, which will then be persisted along with other user data.  Unlike the user pianod password, where we use a 1-way hash validate a password by making sure we come up with the same thing, we must be able to recover the Pandora password to be able to pass it to Pandora.  This implies some level of insecurity; anyone wanting to decrypt the password need only set the breakpoint and examine a variable.

Password security
-----------------

My thinking, then, is to come up with a sufficiently difficult algorithm to make it inconvenient to hand-decipher the password (I'm told there are those that can read ROT13), but nothing truly amazing.  Enough to keep the riff-raff out.

Usernames cannot be changed in pianod.  The user's name will be fed through a 32-bit CRC algorithm to generate a cipher key.  We will then encipher or decrypt the password as follows:

For each character, starting at the beginning:

- XOR the character with the least significant bits of the CRC as follows:

	- 0x01–0x1f (000x xxxx): Assert(0), or do nothing.
	- 0x20–0x3f (001x xxxx): XOR 5 bits
	- 0x40–0x7f (01xx xxxx): XOR 6 bits
	- 0x80–0xff (1xxx xxxx), XOR 7 bits of the CRC.

- Rotate right the CRC by the number of bits "consumed".

While this is certainly not NSA quality, and there are hazards of inventing your own encryption system; but given the inherent insecurity of anyone being able to strategically add 'printf ("%s's password is %s\n", user->password, user->name)' and recompiling, this should be adequate.  It is, after all, only a music server.

Protocol additions
------------------
pandora user commands will include:

[REMEMBER] PANDORA USER {user} {password} [mine|unowned]
> REMEMBER causes the credentials, if approved, to be attached to the requesting user's pianod account.  Previous Pandora credentials will be overwritten, if they exist.
The OWNED BY {user} clause will be allowed but is deprecated, and is not supported with REMEMBER.

USERS LIST OWNERS
> List users with credentials on file.  Available to administrators and those with service privilege (those that can change the Pandora account).

PANDORA USE <pianod-username>
> Select the credentials of the requested pianod user.

pianod web client
-----------------
On the administrator pane section for setting Pandora credentials, there will now be 3 buttons:
Use my known Pandora—uses on-file credentials.
Update my Pandora—allows input into present form
Borrow someone's Pandora—offers a list of users to choose from