full-disclosure - Microsoft's fix for URL containing username:password@ obfuscation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <401808C0.7070606@tco.net.br>
From: Daniel.Capo at tco.net.br (Daniel.Capo@....net.br)
Subject: Microsoft's fix for URL containing username:password@
 obfuscation

What I'd like to know is if they'll do this IN ADDITION to fixing the 
bug or not.

Bobby Brown wrote:

> Summary
> 
> Microsoft plans to release a software update that removes support for handling user names and passwords in HTTP and HTTP with Secure Sockets Layer (SSL) or HTTPS URLs in Microsoft Internet Explorer. The following URL syntax is no longer supported in Internet Explorer or Windows Explorer after you install this software update: 
> 
> http(s)://username:password@...ver/resource.ext
> 
> This article is intended to give you advance notice of this change in Internet Explorer's default behavior. If you include user information in HTTP or HTTPS URLs, Microsoft recommends that you explore the workarounds that are described in this article before you install this software update. Microsoft will post more information in this article when the software update becomes available. 
> 
> 
> http://support.microsoft.com/default.aspx?scid=kb;[LN];834489
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html