bugtraq - Re: stick with "anonymous" or "authenticated" when describing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200412231825.iBNIPaTX025938@linus.mitre.org>
Date: Thu, 23 Dec 2004 13:25:36 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: stick with "anonymous" or "authenticated" when describing

"Jonathan G. Lampe" <jonathan.lampe () standardnetworks ! com> said:

>So...I'd stick with "anonymous" or "authenticated" [instead of
>"credentialed"] when describing attacks on servers.

Based on what I've seen emerging in researcher reports and
vulnerability databases/notification services, the terms
"authenticated user" and "unauthenticated attacker" are emerging with
increasing regularity, especially in "remote" cases (i.e. "remote
authenticated user" and "remote unauthenticated attacker.")  CVE
descriptions are moving in this direction.

The "pre-authentication" term is also emerging for cases in which the
software requires authentication, but the vulnerability appears before
that authentication has taken place.  Obviously not all software uses
authentication, so this isn't exactly the same thing as
"unauthenticated" attacks.

- Steve