Full Disclosure mailing list archives
Re: Filezilla's silent caching of user's credentials
From: Valdis.Kletnieks () vt edu
Date: Thu, 14 Oct 2010 11:51:01 -0400
On Thu, 14 Oct 2010 17:13:04 +0200, Christian Sciberras said:
Valdis, the thing is, if people want their password-keeping software secure, they ought to be limiting access to this said software.
Defense in Depth. It's a Good Idea. Yes, that guy who lost his house and got to watch it burn down because he forgot to pay a $75 fee *should* have paid it. That doesn't mean a policy of "they should have paid, so let it burn if they didn't" is a good idea.
Instead, what we are proposing here is limiting software capability.
File permissions also limit software capability. So tell me - why is 'chmod -R 777 /' a bad idea? After all, /bin/login *should* be stopping unauthorized people from logging in, and authorized users *should* be exercising due diligence in accessing files, so under normal operation, file permissions shouldn't ever reject an attempted access. So why do we have them?
Why? I can't back up the password file reliably anymore, thanks to this "feature".
If you can't create a backup copy of the file, and then restore the exact same pattern of bits when recovering the file, merely because the contents are encrypted, there's something else wrong with your backup scheme.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Filezilla's silent caching of user's credentials, (continued)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 13)
- Re: Filezilla's silent caching of user's credentials silky (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials silky (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials Valdis . Kletnieks (Oct 14)
- Re: Filezilla's silent caching of user's credentials Pete Smith (Oct 14)
- Re: Filezilla's silent caching of user's credentials Adnan Vatandas (Oct 14)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 14)
- Re: Filezilla's silent caching of user's credentials Andrew Farmer (Oct 16)
- Re: Filezilla's silent caching of user's credentials Adnan Vatandas (Oct 14)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 14)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 14)