full-disclosure - Re: HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44188146.9000101@snosoft.com>
Date: Wed Mar 15 21:04:16 2006
From: simon at snosoft.com (Simon Smith)
Subject: Re: HTTP AUTH BASIC monowall.

Dave Korn wrote:
> Simon Smith wrote:
>   
>> Ok,
>>    As suspected... so I am correct; and it is a security threat. I can
>> compromise a network, arp poison it, MiTM, access the firewall,
>> distributed metastasis, presto... owned...
Responding to youw ill be fun...
]\
>   Utter garbage.  
are you from the UK?
> You haven't the faintest understanding of the concepts you 
> are throwing around.  Whatever you do, DO NOT issue a security warning based 
> on this thread, or you will look very foolish.
>   
Who ever said I was going to issue a security advisory or "warning" as
you called it? Why do so many people assume so many things?
>   ARP is no use except to redirect traffic WITHIN THE SAME LAN.  You can't 
> use it to redirect traffic across the internet-at-large.
>   
Gee, you must have missed the entire thread... who said internet?

>   A base 64 encoded string is not a hash.
>   
Ok I used the wrong term... been a long day... so sorry...

>   There's nothing wrong with BASIC AUTH.
>   
Aside from the fact that its... um... insecure?
>   Seriously, if you don't understand what arp is, how the layers of the OSI 
> stack interrelate, or what a hash is, you are fundamentally unaware of the 
> basic concepts of networking and security, how can you possible expect to 
> write a worthwhile security warning?
>   
Well, you are a good example. You don't write very good emails and you
aren't very well aware of the entire email thread now are you? I'll make
it a point to not be as silly as you. ;]

>
>     cheers,
>       DaveK
>   

AH you are from the UK, you said Cheers!


-- 


Regards, 
	Adriel T. Desautels
	Harvard Security Group
	http://www.harvardsecuritygroup.com