full-disclosure - Re: pgp passphrase

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040323061313.GO2904@hockwold.net>
From: warlock at eskimo.com (Jim Richardson)
Subject: Re: pgp passphrase

On Mon, Mar 22, 2004 at 08:29:03PM -0600, Paul Schmehl wrote:
>--On Monday, March 22, 2004 4:03 PM -0800 Denis Dimick <denis@...ick.net> 
>wrote:
>
>>
>>Most smart users.. Ok start the laughing now.. Have a passcode for their
>>keys..
>>
>>:)
>>
>No, really????
>
>And if I 0wn your box, do you not think that my keylogger can get your 
>passcode?  Good grief!  If the box is hacked, I can get any information I 
>need from you to screw you up further.  Passcodes or anything else you have 
>*or* type are trivial to obtain once I have root on the box.
>
>I'm a bit surprised that I have to point this out.


since the context of this discussion was email worms and trojans, and a
certain OS/App combination's vulnerability to same, I'd say that wrt to
*nix like OSen, 

"if you had some ham, you could have ham and eggs, if you only had some
egss."

or to paraphrase South park

1) Send email trojan
2) ???
3) Got root...


My MUA doesn't execute attachements, does that mean I am invulnerable?
no, just far less vulnerable than someone who's relying on an MUA that
can't tell the difference between open() and exec()


-- 
Jim Richardson     http://www.eskimo.com/~warlock
Ok, the guy who made the netfilter Makefile was probably on some really
interesting and probably highly illegal drugs when he wrote it.
	-- Linus Torvalds 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040322/7e3496a9/attachment.bin