bugtraq - Re: MS to stop allowing passwords in URLs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040203130955.6a00bdfe.dbharris@eelf.ddts.net>
Date: Tue, 3 Feb 2004 13:09:55 -0500
From: David B Harris <dbharris@...f.ddts.net>
To: bugtraq@...urityfocus.com
Subject: Re: MS to stop allowing passwords in URLs

On Mon, 2 Feb 2004 21:01:45 -0700
"Dave Warren" <dave.warren@...ilsplayground.net> wrote:
> The safety concerns of http://user:pass@www aren't technical, they're
> user/training issues..  How do you explain to your grandmother that
> http://www.herbank.com:login.asp@...sion-arhuz.ru/ isn't safe but
> http://www.herbank.com/login.asp?arhuz.ru/ is okay?
> 
> The solution, in my opinion, would be to come up with a new notation that
> doesn't break existing RFCs, but that still places the hostname first.

Or, hey, a different on-screen representation? Something like, I dunno,
"http://user:pass@...e/" being turned into "http://site/ (user: user,
password: pass)"?

If you're worried about anything *other* than either the URL bar or the
status bar (like, for instance, the descriptive text of the link),
you're out of luck anyways. People who would still fall for that will
also fall for <a
href="http://www.please-crack-me.ru">http://www.microsoft.com</a>

Seriously, KISS. ("Keep It Simple, Stupid" for those who either aren't
familiar with the jargon or aren't native English speakers ;)