full-disclosure - Re: Re: Re: open telnet port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: lists at ktabic.co.uk (ktabic)
Subject: Re: Re: Re: open telnet port

On Fri, 2004-09-10 at 14:16 -0700, Andrew Farmer wrote:

> > Given that above description, there is no mention of anybody sending
> > anything that even looks like a password over the net in plain text.
> > Of course, most people would be, but not everyone.
> > You are also presuming that the root account even requires logging in,
> > which is also not nessercary.
> 
> What, are you advocating that we set our root accounts to not require
> a password to log in?

*sigh* Who said anything about root accounts with no passwords? Or is
that just the limit that you can go to? An why even use the root
account? Attempted root logins can be used as an indicator that
something (or someone) is trying to gain access. And it is a generally
unwise idea to log in as root, especially remotely. You might break you
system and not be able to fix it. Which is precisly how we got to this
topic in the first place.
There are other ways you know.
(Point of fact, of the triad of authentification systems, something you
know, something you have and something you are, something you know is
the worse of them, and if you are *really* intrested in secure logins,
with or without encryption, you don't just use something you know)
> 
> > There is nothing wrong with plain text at all, in most circumstances.
> > It's just that *everyone* has presumed that passwords that are a) 
> > reused
> > for the next session and b) the root one, will be sent in plain text.
> 
> As far as I know, there are no current Telnet server implementations 
> that
> will encrypt login passwords (or other passwords entered during the 
> login
> session: the user's password for su or sudo, gpg passphrases, ...)
> 
Ah, you are so close! sudo doesn't always need a password, btw.
And that isn't just the limit, either. Ever tried OPIE?

> > Of course, if you know you are sending in plain text, you take steps to
> > make sure that nothing critical is transmitted in the first place,
> > which, imho is a better situation than relying totally on the fact you
> > are encrypted, which may or may not be true.
> 
> Not plaintext === encrypted.
> 
> What are you trying to say here?

Should be easy enough. Plaintext == not encrypted, however, plaintext
doesn't mean critical information being passed across the net in the
first place. See where I'm coming from now? It always struck me as an
easy enough concept.