| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040208184510.GA19669@php.net> From: s.esser at e-matters.de (Stefan Esser) Subject: Apparently the practice was prevalent It is unbelievable that the media is spreading such FUD about the URL passwords. The URL passwords are as secure as HTTP-Auth, because they are just a way to tell the browser what HTTP-Auth l/p combination should be used. The URLs as they are get NEVER transmitted through the internet in that form. Well except you send the link by email, im, whatever. But this is a stupid argument, because that is equal to sending the link without the u/p and telling it the person in the next sentence of your mail. The only good thing in this article is the message, that it breaks thousands of applications and produces tons of unnecessary costs. Well and it is now impossible to get HTTP URLs that are protected by HTTP-Auth mechanism. The APIs are not designed to provide username/password combinations in another way. If it improves security that people cannot use password protected directories anymore... I doubt, I doubt. Stefan -- -------------------------------------------------------------------------- Stefan Esser s.esser@...atters.de e-matters Security http://security.e-matters.de/ GPG-Key gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 Key fingerprint B418 B290 ACC0 C8E5 8292 8B72 D6B0 7704 CF6C AE69 -------------------------------------------------------------------------- Did I help you? Consider a gift: http://wishlist.suspekt.org/ --------------------------------------------------------------------------
Powered by blists - more mailing lists