| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040206021736.MWQY266366.fep01-mail.bloor.is.net.cable.rogers.com@BillDell> From: full-disclosure at royds.net (Bill Royds) Subject: Interesting side effect of the new IE patch Amy browser that allows an HTTP URL with an @ sign in it is buggy and should be fixed. HTTP URLs are not RFC compliant if the have the user:password@...t syntax. Any browser that allows this has a bug and not a feature. Microsoft fixed their bug and you are complaining about a bug and vulnerability fix because it removes some exploits. So Fiat depended on buggy browsers working in a particular way. When someone fixes the bug they get screwed. I feel no sympathy. Microsoft finally did the right thing and fixed their browsers. How long do you think it will take for Mozilla and Opera and Safari to change as well? The only thing that should be done for legitimate programmed uses of an account and password is to add HTTP headers to the RFC (RFC 2616) to allow Username, authentication type and password. USERNAME:DumbLuser Authentication-type:plainText Password:foolish -----Original Message----- From: full-disclosure-admin@...ts.netsys.com [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Stefan Esser Sent: February 5, 2004 1:54 PM To: Daniele Muscetta Cc: full-disclosure@...ts.netsys.com Subject: Re: [Full-Disclosure] Interesting side effect of the new IE patch Hello, > FIAT (the famous Italian CAR producer) invested quite an amount of money > and effort in lauching the promotional site: > http://www.buy@...t.com > > ....I think they must not be very happy now..... :( Of course they are not happy now. Like a lot of other people who relied on this standard. It is really sad, that Microsoft removes features because they are to lazy to think up other solutions. Like showing the username, password in a different color, not showing it at all... It is one thing to remove a feature because it is like writing the password to the back of your keyboard but it is another thing to just remove it because you have no clue how to make it obvious for people that this is not part of the servername. If Microsoft would care about the "password written on the backside" problem they would have to remove all password remembering functions from IE. Removing this feature did not make HTTP/HTTPS more secure it just forces people to attach notes to their monitor again or to use the "remember my password" feature. (Oh yeah and this is not a Microsoft only problem, or why do f.e. openssh/openssl allow RSA keys without passphrases?) Ohh yes and I choose the word standard, because standard is not what some RFC/paper dictates, but what the majority of people (or browsers) use (support). NTSC would not exist otherwise, because NTSC was NOT the official standard for color television in the beginning. Stefan -- -------------------------------------------------------------------------- Stefan Esser s.esser@...atters.de e-matters Security http://security.e-matters.de/ GPG-Key gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 Key fingerprint B418 B290 ACC0 C8E5 8292 8B72 D6B0 7704 CF6C AE69 -------------------------------------------------------------------------- Did I help you? Consider a gift: http://wishlist.suspekt.org/ -------------------------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Powered by blists - more mailing lists