bugtraq - Re: MS to stop allowing passwords in URLs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200402040807.i1487RTL018658@samson.dc.luth.se>
Date: Wed, 04 Feb 2004 09:07:26 +0100
From: Gunnar "Östlund" <kalix@...luth.se>
To: "Dave Warren" <dave.warren@...ilsplayground.net>
Cc: "McAllister, Andrew" <McAllisterA@...ystem.edu>,
	bugtraq@...urityfocus.com, kalix@...luth.se
Subject: Re: MS to stop allowing passwords in URLs

> It's probably too late, but rather then removing user:password support
> altogether, maybe Microsoft could replace it with a dialog that informs the
> user they are about to visit "session-arhuz.ru" with the username
> "www.herbank.com", and an appropriate warning about not revealing sensitive
> information, blahblahblah?

As an answer to the question "Are you sure that you want to... bla,bla ...as 
this may reveal sensitive information?", 99% of the users will click "Yes" as 
they always do.

Even if the question is phrased "...do you wish to abort this action?", most 
users will simply try a few times by clicking "yes" and finally actually read 
the question and the warning before clicking "no".

The problem is that most people do not cultivate the high-grade paranoia that 
most readers of Bugtraq do, and that is what makes security so difficult to 
implement, especially if security is to be retrofitted to a protocol or 
product. People make the choices that is most convenient to their daily use; 
allow everything, don't upgrade, don't patch.

In fact, most people don't even know why they should patch. I've even heard 
the urban legend that running Microsoft Update is dangerous as your computer 
may get infected by computer viruses that way.

-- 
Gunnar Ostlund                  Tel: +46 920 492039
Computer Support Centre         Email: Gunnar.Ostlund@...luth.se
Lulea University of Technology
S-971 87 Lulea
Sweden