lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <200310300712.IAA12995@galaxy.hbg.de.ao-srv.com>
From: helge.oldach at atosorigin.com (Helge Oldach)
Subject: TinyURL

Joel R. Helgeson:
>Who cares about credit card numbers, I'm looking for privileged access to
>sites.  Consider the following:
>
>People use this service as an attempt to obfuscate the usernames and
>passwords to protected websites and ftp servers that they email out.  I'm
>finding a lot of urls that read like:
>http://username:password@....protectedsite.com/members
>ftp://user:pass@....securedftp.com/private/sourcecode
>
>Looks like they wanted to get someone into their site, but didn't want to
>actually 'give' the username and password out, so they tinyurl'ed it.
>
>This means they've posted their username and password to the entire web!!

So what is your point? Are you trying to prevent people from doing
stupid things like posting their credentials to the web?

I must say I find the fuzz about this "service" rather strange. This
topic is not related to security, but simply to stupidity.

You should better ask tinyurl to place a warning on their site. I
suggest "Not suitable for children under 3 years".

Helge


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ