Use an empty challenge for the password question If a question's challenge is NULL, it is unnecessarily difficult for a responder callback to detect whether it was asked. So it's better to use an empty challenge when there is no challenge data to communicate. Do this for the "password" question. https://github.com/krb5/krb5/commit/70f2d9a093c71624269b2317c62ad0993126bc40 Author: Greg Hudson Commit: 70f2d9a093c71624269b2317c62ad0993126bc40 Branch: master src/lib/krb5/krb/gic_pwd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)