nanog mailing list archives
Re: mail admins?
From: Rich Kulawiec <rsk () gsp org>
Date: Sun, 26 Apr 2020 10:32:01 -0400
On Thu, Apr 23, 2020 at 07:56:30PM -0700, Michael Thomas wrote:
$SHINYNEWSITE has only to entice you to enter your reused password which comes out in the clear on the other side of that TLS connection.?? basically password phishing. you can whine all you like about how stupid they are, but you know what... that is what they average person does. that is reality. js exploits do not hold a candle to that problem.
Two equally large problems -- neither of which have anything to do with encryption in transport -- are backend security and password strength. In the former case, we've seen an ongoing parade of security breaches and subsequent dataloss incidents. That parade is still going on. In the latter case, despite years of screaming from the rooftops, despite myriad enforcement attempts in code, despite another parade of incidents, despite everything, we still have people using "password" as a password. As a side note, I've found it nearly impossible to get users to understand that there is a qualitative and quantitative difference between "password used for brokerage account" and "password used for little league baseball mailing list". The minor problem of passwords-over-the-wire pales into insignificance compared to these (and others -- but that's a long list). ---rsk
Current thread:
- Re: mail admins?, (continued)
- Re: mail admins? William Herrin (Apr 23)
- Re: mail admins? Michael Thomas (Apr 23)
- Re: mail admins? Matt Palmer (Apr 23)
- Re: mail admins? Michael Thomas (Apr 23)
- Re: mail admins? Matt Palmer (Apr 23)
- Re: mail admins? Michael Thomas (Apr 24)
- Re: mail admins? Bryan Holloway (Apr 24)
- Re: mail admins? Michael Thomas (Apr 24)
- Re: mail admins? Raymond Burkholder (Apr 23)
- Re: mail admins? Michael Thomas (Apr 23)
- Re: mail admins? Rich Kulawiec (Apr 26)
- Re: mail admins? Michael Thomas (Apr 26)
- Re: mail admins? Matt Palmer (Apr 26)
- Re: mail admins? Michael Thomas (Apr 26)
- Re: mail admins? Matt Palmer (Apr 26)
- Re: mail admins? Michael Thomas (Apr 27)
- Re: mail admins? William Herrin (Apr 27)
- Re: mail admins? Michael Thomas (Apr 27)