full-disclosure - Interesting side effect of the new IE patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040206195733.GC9205@sherohman.org>
From: esper at sherohman.org (Dave Sherohman)
Subject: Interesting side effect of the new IE patch

On Fri, Feb 06, 2004 at 07:28:18PM +0100, Stefan Esser wrote:
> a) people write passwords into their URLs  (valid point)
>    (but if they cannot write it into URLs they will store it into
>    IE password remembering function or attach some notes to their
>    monitor, so removing this feature has NOT improved security)

Yes it has.  The contents of MSIE's rembering function and even notes
on the monitor are not sent over the public internet in cleartext or
recorded in server access (or, worse, referer, if the browser is
sufficiently simple-minded) logs.

It hasn't completely fixed security, but it has improved the
situation somewhat.

-- 
The freedoms that we enjoy presently are the most important victories of the
White Hats over the past several millennia, and it is vitally important that
we don't give them up now, only because we are frightened.
  - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html)