Re: InterNIC Shenanigans (crypt-pw)

[steve () edmweb com (Steve Reid)]

> PGP auth scheme also seems vulnerable to replay attacks.

I would guess that they're only trying to defend against simple forgeries,
such as faked email addresses. Forged mail can be done by any luser with a
copy of Eudora. Replay attacks require root access on a properly placed
host (in which case you probably have more to worry about than altered DNS
info).

OTOH, if they just want to protect against simple forgeries, the use of
PGP and even crypt(3) is overkill. A simple plaintext password would
suffice.

*shrug*