bugtraq - Re: MS to stop allowing passwords in URLs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 03 Feb 2004 16:52:34 +0000
From: Paul Smith <paullocal@...s.co.uk>
To: <bugtraq@...urityfocus.com>
Subject: Re: MS to stop allowing passwords in URLs


At 22:54 28/01/2004, McAllister, Andrew wrote:
>I just read that Microsoft will stop allowing IDs and passwords to be
>embedded in URLs used by Internet Explorer. So you will no longer be
>able to use a URL like https://user:password@....somehost.com/
>
>See http://support.microsoft.com/default.aspx?scid=kb;en-us;834489

>Anyone have any comments regarding legitimate uses of this syntax and
>Microsoft removing it from their browser? (and presumably the OS since
>the browser IS the OS).

Personally, I think it's a reasonable step - these spoofed URLs are a big 
problem for many people.

You can disable the functionality in IE if you wish (the above link has 
details)

I think I'd prefer it if you could override it on a site by site basis (eg 
using the 'trusted sites' functions, or by having the username:password@url 
in your IE 'favourites')

(Although, having said that, having spammers use http://username@url is 
quite a good trigger to put in email anti-spam rules, as I've never seen 
anyone use that format in an email link legitimately..)
Paul				VPOP3 - Internet Email Server/Gateway
support@...s.co.uk			http://www.pscs.co.uk/