[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <000701c646f9$40244e40$0200a8c0@kpllaptop>
Date: Mon Mar 13 23:53:22 2006
From: lyal.collins at key2it.com.au (Lyal Collins)
Subject: HTTP AUTH BASIC monowall.
I find a central issue that often reoccurs when discussing secure protocols
is the definition of where the secure protocol starts and stops - the user,
the application, or some underlying OS/functional library or network device?
There are usually huge chasms between the business, legal and
technical/security guru perspective on this - but in my experience these
differences significantly influence purchase and implementation budget
decisions.
Lyal
-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Jeremy
Bishop
Sent: Tuesday, 14 March 2006 10:40 AM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] HTTP AUTH BASIC monowall.
On Monday 13 March 2006 15:17, Lyal Collins wrote:
> Yup, that's right: All PKI authentication is only as good as the
> passwords protecting private keys where such passwords exist, and the
> complementary endpoint security controls.
<snip>
I thought you might be meaning something like that. I would say that
these problems are out of scope for a discussion of secure
communication protocols. E.g. Alice is considered synonymous with her
computer. Once you open up the possibility that Alice (or Bob) have
been hacked, there's no real point to discussing how to secure her
communications. But in a more pedantic sense, yes, you are correct.
Jeremy
--
Fix reason firmly in her seat, and call to her tribunal every fact, every
opinion. Question with boldness even the existence of a god; because, if
there be one, he must approve the homage of reason rather than of
blind-folded fear.
-- Thomas Jefferson, 1787
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists