full-disclosure - Re: Filezilla's silent caching of user's credentials

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 Oct 2010 17:13:04 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk, Mutiny <mutiny@...inbeardsucks.com>
Subject: Re: Filezilla's silent caching of user's
	credentials

Valdis, the thing is, if people want their password-keeping software secure,
they ought to be limiting access to this said software.
Instead, what we are proposing here is limiting software capability.
Why? I can't back up the password file reliably anymore, thanks to this
"feature".
I can't understand why we are encrypting the file from this level, rather
than relying on the environment.
The only reason I can see so far (which you and others have repeatedly
cited) is that the said
environment *might* not be secure. My opinion about this? I'd rather have to
fix the environment than
have to maintain both. Then again, security is all about layers and adding
bloat upon bloat to somewhat limit access.

Since there seems to be some sort of "standard" which everyone seems to have
agreed on, this is where I quit.
Though I still see this idea as simply adding bloat without a real cause.

On Thu, Oct 14, 2010 at 4:49 PM, <Valdis.Kletnieks@...edu> wrote:

> On Thu, 14 Oct 2010 10:20:30 +0200, Christian Sciberras said:
> > And that is my point exactly. While I'm shouting out loud, let me ask a
> question:
> > How many FD readers are dumb enough to share their harddisks with the
> world?
> > None? So what is the problem in using FileZilla personally? I mean,
> anyone which
> > takes security seriously, would be encrypting their drive in the first
> > place.
>
> The problem is that "FD readers" and "anyone who takes security seriously"
> are
> vanishingly small corners of the total Internet population.  Yes, there may
> be
> 5,000 race car drivers in the US who can do amazing drifts and the like if
> a
> car isn't equipped with anti-lock brakes.  That doesn't mean that they
> aren't a
> better choice for the other 200 million drivers in the US.  Similarly, the
> fact
> that a security feature isn't strictly needed on the 0.2% of systems that
> are
> properly administered doesn't mean that the programmer shouldn't be
> thinking
> about the other 99.8% of users where the feature will add incremental
> benefit.
>
> Think: Why does SSH use a passphrase to protect your private key by
> default,
> and why does it allow the *optional* omission of said passphrase? Why
> shouldn't
> the exact same reasoning apply to all other software that stores
> credentials?
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/