full-disclosure - Interesting side effect of the new IE patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040205185418.GA32742@php.net>
From: s.esser at e-matters.de (Stefan Esser)
Subject: Interesting side effect of the new IE patch

Hello,

> FIAT (the famous Italian CAR producer) invested quite an amount of money
> and effort in lauching the promotional site:
> http://www.buy@...t.com
> 
> ....I think they must not be very happy now..... :(

Of course they are not happy now. Like a lot of other people who relied
on this standard. It is really sad, that Microsoft removes features
because they are to lazy to think up other solutions. Like showing
the username, password in a different color, not showing it at all...
It is one thing to remove a feature because it is like writing the
password to the back of your keyboard but it is another thing to 
just remove it because you have no clue how to make it obvious for
people that this is not part of the servername. 

If Microsoft would care about the "password written on the backside"
problem they would have to remove all password remembering functions
from IE. Removing this feature did not make HTTP/HTTPS more secure
it just forces people to attach notes to their monitor again or to
use the "remember my password" feature.
(Oh yeah and this is not a Microsoft only problem, or why do f.e.
openssh/openssl allow RSA keys without passphrases?)

Ohh yes and I choose the word standard, because standard is not what
some RFC/paper dictates, but what the majority of people (or browsers)
use (support). NTSC would not exist otherwise, because NTSC was NOT
the official standard for color television in the beginning.

Stefan

-- 

--------------------------------------------------------------------------
 Stefan Esser                                        s.esser@...atters.de
 e-matters Security                         http://security.e-matters.de/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
 Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
--------------------------------------------------------------------------
 Did I help you? Consider a gift:            http://wishlist.suspekt.org/
--------------------------------------------------------------------------