bugtraq - Re: Popular Net anonymity service back-doored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030821214133.04C4D43F953@phoenix.clouddancer.com>
Date: Thu, 21 Aug 2003 14:41:33 -0700 (PDT)
From: Aron Nimzovitch <crypto@...uddancer.com>
To: thomas.greene@...register.co.uk
Cc: fw@...eb.enyo.de, bugtraq@...urityfocus.com,
	full-disclosure@...ts.netsys.com
Subject: Re: Popular Net anonymity service back-doored

   Mailing-List: contact bugtraq-help@...urityfocus.com; run by ezmlm
   From: "Thomas C. Greene " <thomas.greene@...register.co.uk>
   Organization: The Register

   Leaving a hint in the source and waiting for someone to call them on it may be 
   a legal strategem, but it's not a good way of maintaining user
   trust.

Only a fool would blindly depend on someone else's software to gain
anonymity without examining the code.  If you need anonymity, then you
should easily be willing to invest sweat equity, or have a contractual
arrangement when the threat is only financial.  For more serious
threats requiring anonymity, not reviewing the source when it is
available seems beyond stupid.  I could unserstand your ire if you
were one of our clients, but this was a free service wasn't it?

FAR