bugtraq - Re: ERRATA (Re: "Host header cannot be trusted as an anti anti DNS-pinning measure")

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <28bb57460612261245g4e759a27uba6fc6ee8f8cce9b@mail.gmail.com>
Date: Tue, 26 Dec 2006 21:45:41 +0100
From: "Martin Johns" <martin.johns@...il.com>
To: "Amit Klein" <aksecurity@...il.com>
Cc: bugtraq@...urityfocus.com, websecurity@...appsec.org,
	webappsec@...urityfocus.com
Subject: Re: ERRATA (Re: "Host header cannot be trusted as an anti anti DNS-pinning measure")

I have just been told that the real name of "timeless" is Josh Soref
(apparently a well-known Mozilla contributor). I made the same wrong
reference in my post on breaking DNS-pinning
(http://shampoo.antville.org/stories/1451301).

Best,
Martin


On 12/25/06, Amit Klein <aksecurity@...il.com> wrote:
> Hi
>
> In the writeup named "Host header cannot be trusted as an anti anti
> DNS-pinning measure" (submitted September 7th, 2006) I erroneously
> attributed one of the references to the wrong person. The correct text
> should read:
>
> [1] "DNS: Spoofing and Pinning", by "timeless", September 12th, 2003 (or
> earlier)
> http://viper.haque.net/~timeless/blog/11/
>
> The original (wrong) text attributed this reference to Mohammad A.
> Haque, who owns the viper.haque.net website, but (in my current
> understanding) did not write the referenced text (my understanding now
> is that http://viper.haque.net/~timeless/ actually belongs to
> "timeless", a different individual).
>
> This mistake also occurred in a response I wrote to a thread "Re: [WEB
> SECURITY] Detecting, Analyzing, and Exploiting Intranet Applications
> using JavaScript" in the WebSecurity mailing list
> (http://www.webappsec.org/lists/websecurity/archive/2006-07/msg00090.html).
>
> I'm sorry for the confusion.
> -Amit
>
>
>
>


-- 
Martin Johns
http://www.martinjohns.com