full-disclosure - Re: Plain Text Password Disclosure vulnerability in rediff mail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 11 Sep 2009 17:27:41 -0400
From: Valdis.Kletnieks@...edu
To: full-censorship@...hmail.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Plain Text Password Disclosure vulnerability
	in rediff mail

On Fri, 11 Sep 2009 21:49:00 BST, you said:

> would one not rather hire someone *not* well-known and *doesn't* 
> get owned?

Feel free to hire that guy flipping burgers at McD's to do your security
assessment.  Let me know how it turns out.

Also, remember that there is an asymmetric component to this - the sysadmin
has to stop *every* attack to remain un-owned, but the attacker only needs one.

And there's always the "security is tradeoffs" component - Dan's a smart guy,
and knows he can't secure every server perfectly.  So he figures out what he
has to do to limit the likelyhood, and takes his chances.  If you estimate that
a server of yours will be hacked once every year, and cost you $1,200 to clean
up, then if you're spending more than $100/month in security you're being an
idiot.  Especially if you can do good PR spin on it:

"I'm Dan Kaminsky - hated by hackers the world over.  Our systems average
25,392 attacks per day, and in 4 years only one has gotten through.  If we
can do that when under attack by the worst the world has to offer, imagine
what we can do for *your* business."

:)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/