full-disclosure - Re: Filezilla's silent caching of user's credentials

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 14 Oct 2010 11:51:01 -0400
From: Valdis.Kletnieks@...edu
To: Christian Sciberras <uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, Mutiny <mutiny@...inbeardsucks.com>
Subject: Re: Filezilla's silent caching of user's
	credentials

On Thu, 14 Oct 2010 17:13:04 +0200, Christian Sciberras said:

> Valdis, the thing is, if people want their password-keeping software secure,
> they ought to be limiting access to this said software.

Defense in Depth.  It's a Good Idea.

Yes, that guy who lost his house and got to watch it burn down because he
forgot to pay a $75 fee *should* have paid it.  That doesn't mean a policy
of "they should have paid, so let it burn if they didn't" is a good idea.

> Instead, what we are proposing here is limiting software capability.

File permissions also limit software capability.

So tell me - why is 'chmod -R 777 /' a bad idea? After all, /bin/login *should*
be stopping unauthorized people from logging in, and authorized users *should*
be exercising due diligence in accessing files, so under normal operation,
file permissions shouldn't ever reject an attempted access.  So why do we
have them?

> Why? I can't back up the password file reliably anymore, thanks to this
> "feature".

If you can't create a backup copy of the file, and then restore the exact same
pattern of bits when recovering the file, merely because the contents are
encrypted, there's something else wrong with your backup scheme.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/