full-disclosure - Teen hacker controls ebay

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: fw at deneb.enyo.de (Florian Weimer)
Subject: Teen hacker controls ebay

* ?ber GuidoZ:

> I believe it was done through email. DENIC received the request to
> change the DNS, then emailed Tucows to see if it was ok to make the
> changes. By default, the answer is yes. So, since no one responded
> saying "Hell no! Don't do that", the changes were made.
>
> Personally, I can't comprehend how the default for something like that
> would be "Yes", as it's easy to have email get lost, stopped as spam,
> overlooked, etc.

Network Solutions is being slammed because they recently made the
default "no". 8-/

> The default answer should be No, which you have to change by an
> email.

That's why many registrars answer with an automated "no" (which can be
overridden manually if necessary during the next couple of weeks).

> (Not that it's difficult to spoof an email address... hence why DNS
> changes and such should NEVER be done through email.)

Nowadays, all messages should be signed with OpenPGP.