full-disclosure - Re: Port Randomization: New revision of our IETF Internet-Draft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 2 Sep 2008 07:15:20 -0700
From: coderman <coderman@...il.com>
To: "Fernando Gont" <fernando.gont@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Port Randomization: New revision of our IETF
	Internet-Draft

On Tue, Sep 2, 2008 at 2:06 AM, Fernando Gont <fernando.gont@...il.com> wrote:
> ... there's no description of what Windows does

some things speak for themselves... :)

> Also, the base Linux system already implements Algorithm #3... why
> ... patch

if you seed/key #3 poorly, as just one example. (which you reference
via RFC4086, etc)

> P.S.: The "survey" section must be about 1% of the document. I'd be glad to
> hear comments on the rest of the document.

sure...  section #4 should be:
s/should consider randomizing/must randomize/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/