lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: full-disclosure at royds.net (Bill Royds)
Subject: Interesting side effect of the new IE patch

Amy browser that allows an HTTP URL with an @ sign in it is buggy and should
be fixed.
HTTP URLs are not RFC compliant if the have the user:password@...t syntax.
Any browser that allows this has a bug and not a feature.
Microsoft fixed their bug and you are complaining about a bug and
vulnerability fix because it removes some exploits.
 So Fiat depended on buggy browsers working in a particular way. When
someone fixes the bug they get screwed. I feel no sympathy.

Microsoft finally did the right thing and fixed their browsers. How long do
you think it will take for Mozilla and Opera and Safari to change as well?

The only thing that should be done for legitimate programmed uses of an
account and password is to add HTTP headers to the RFC (RFC 2616) to allow
Username, authentication type and password.

USERNAME:DumbLuser
Authentication-type:plainText
Password:foolish


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Stefan Esser
Sent: February 5, 2004 1:54 PM
To: Daniele Muscetta
Cc: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] Interesting side effect of the new IE patch

Hello,

> FIAT (the famous Italian CAR producer) invested quite an amount of money
> and effort in lauching the promotional site:
> http://www.buy@...t.com
> 
> ....I think they must not be very happy now..... :(

Of course they are not happy now. Like a lot of other people who relied
on this standard. It is really sad, that Microsoft removes features
because they are to lazy to think up other solutions. Like showing
the username, password in a different color, not showing it at all...
It is one thing to remove a feature because it is like writing the
password to the back of your keyboard but it is another thing to 
just remove it because you have no clue how to make it obvious for
people that this is not part of the servername. 

If Microsoft would care about the "password written on the backside"
problem they would have to remove all password remembering functions
from IE. Removing this feature did not make HTTP/HTTPS more secure
it just forces people to attach notes to their monitor again or to
use the "remember my password" feature.
(Oh yeah and this is not a Microsoft only problem, or why do f.e.
openssh/openssl allow RSA keys without passphrases?)

Ohh yes and I choose the word standard, because standard is not what
some RFC/paper dictates, but what the majority of people (or browsers)
use (support). NTSC would not exist otherwise, because NTSC was NOT
the official standard for color television in the beginning.


Stefan

-- 

--------------------------------------------------------------------------
 Stefan Esser                                        s.esser@...atters.de
 e-matters Security                         http://security.e-matters.de/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
 Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
--------------------------------------------------------------------------
 Did I help you? Consider a gift:            http://wishlist.suspekt.org/
--------------------------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Powered by blists - more mailing lists