full-disclosure - Re: Plain Text Password Disclosure vulnerability in rediff mail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 10 Sep 2009 11:36:09 -0400
From: awf awf <lol-wut-hurr@...e.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: Plain Text Password Disclosure vulnerability
	in rediff mail

And?  Every web application sends passwords as plain text unless they are using SSL.  Pretty much any "encryption" that they may do client side that isn't SSL is meaningless.  I hardly see how being able to sniff passwords from a site that isn't using SSL is big news.

_________________________________________________________________
Windows Live: Make it easier for your friends to see what you’re up to on Facebook.
http://windowslive.com/Campaign/SocialNetworking?ocid=PID23285::T:WLMTAGL:ON:WL:en-US:SI_SB_facebook:082009
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/