bugtraq - RE: MS to stop allowing passwords in URLs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E525222439A3D111B5F600609712CBEDA24D27@mail.biac.duke.edu>
Date: Tue, 3 Feb 2004 13:24:09 -0500
From: Francis Favorini <francis.favorini@...e.edu>
To: bugtraq@...urityfocus.com
Subject: RE: MS to stop allowing passwords in URLs


Vinny Abello [mailto:vinny@...lurian.com] wrote...
> Interestingly, I've already found that this patch doesn't fix
> this problem when using IE as an object in VB6.

>From the KB article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;834489
"After you install the 832894 security update, you can set registry values
to use this new behavior in other programs that host the Web browser control
or to disable this new behavior for Windows Explorer and Internet Explorer."

The specifics of the registry values are also documented therein.

-FF