full-disclosure - Re: HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8C816AEC50B93C9-C34-1E82@MBLK-M06.sysops.aol.com>
Date: Thu Mar 16 01:19:32 2006
From: greybrimstone at aim.com (greybrimstone@....com)
Subject: Re: HTTP AUTH BASIC monowall.

Simon,
      You're a moron.

-Adriel

-----Original Message-----
From: Simon Smith <simon@...soft.com>
To: Dave Korn <davek_throwaway@...mail.com>
Cc: full-disclosure@...ts.grok.org.uk
Sent: Wed, 15 Mar 2006 16:04:06 -0500
Subject: Re: [Full-disclosure] Re: HTTP AUTH BASIC monowall.

  Dave Korn wrote:
> Simon Smith wrote:
>
>> Ok,
>>    As suspected... so I am correct; and it is a security threat. I 
can
>> compromise a network, arp poison it, MiTM, access the firewall,
>> distributed metastasis, presto... owned...
Responding to youw ill be fun...
]\
>   Utter garbage.
are you from the UK?
> You haven't the faintest understanding of the concepts you
> are throwing around.  Whatever you do, DO NOT issue a security 
warning based
> on this thread, or you will look very foolish.
>
Who ever said I was going to issue a security advisory or "warning" as
you called it? Why do so many people assume so many things?
>   ARP is no use except to redirect traffic WITHIN THE SAME LAN.  You 
can't
> use it to redirect traffic across the internet-at-large.
>
Gee, you must have missed the entire thread... who said internet?

>   A base 64 encoded string is not a hash.
>
Ok I used the wrong term... been a long day... so sorry...

>   There's nothing wrong with BASIC AUTH.
>
Aside from the fact that its... um... insecure?
>   Seriously, if you don't understand what arp is, how the layers of 
the OSI
> stack interrelate, or what a hash is, you are fundamentally unaware 
of the
> basic concepts of networking and security, how can you possible 
expect to
> write a worthwhile security warning?
>
Well, you are a good example. You don't write very good emails and you
aren't very well aware of the entire email thread now are you? I'll make
it a point to not be as silly as you. ;]

>
>     cheers,
>       DaveK
>

AH you are from the UK, you said Cheers!


--


Regards,
    Adriel T. Desautels
    Harvard Security Group
    http://www.harvardsecuritygroup.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


________________________________________________________________________
Check Out the new free AIM(R) Mail -- 2 GB of storage and 
industry-leading spam and email virus protection.