full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200603131539.57882.requiem@praetor.org>
Date: Mon Mar 13 23:39:51 2006
From: requiem at praetor.org (Jeremy Bishop)
Subject: HTTP AUTH BASIC monowall.

On Monday 13 March 2006 15:17, Lyal Collins wrote:
> Yup, that's right: All PKI authentication is only as good as the
> passwords protecting private keys where such passwords exist, and the
> complementary endpoint security controls.

<snip>

I thought you might be meaning something like that.  I would say that 
these problems are out of scope for a discussion of secure 
communication protocols.  E.g. Alice is considered synonymous with her 
computer.  Once you open up the possibility that Alice (or Bob) have 
been hacked, there's no real point to discussing how to secure her 
communications.  But in a more pedantic sense, yes, you are correct.

Jeremy

-- 
Fix reason firmly in her seat, and call to her tribunal every fact,
every opinion. Question with boldness even the existence of a god;
because, if there be one, he must approve the homage of reason rather
than of blind-folded fear.
                     -- Thomas Jefferson, 1787