Bugtraq mailing list archives
Re: Webmail.bellsouth.net security problems
From: emarshal () LOGIC NET (Edward S. Marshall)
Date: Tue, 25 Aug 1998 21:19:55 -0500
On Tue, 25 Aug 1998, Marc Slemko wrote:
This is one of the situations where cookies are actually one of the better solutions. HTTP authentication is even better, but many people dislike it because they can't control the login prompt and due to how it can be cached by the client.
Another solution is to supply this data via POST instead of in the URL. While it has an impact on design (everything has to be submitted via buttons instead of just clicking links), it avoids any data being sent in the URL. Do this with SSL, and the data should never be cached by an intermediate machine. SSL is a must with this type of thing anyway; the whole caching issue becomes moot that way, along with a number of other security concerns. -- -------------------. emarshal at logic.net .--------------------------------- Edward S. Marshall `-----------------------' http://www.logic.net/~emarshal/
Current thread:
- Serious Security Hole in Hotmail Tom Cervenka (Aug 24)
- Re: Serious Security Hole in Hotmail Jeff Mcadams (Aug 25)
- Re: Serious Security Hole in Hotmail Jonathan A. Zdziarski - Systems Administrator (Aug 25)
- Webmail.bellsouth.net security problems Leonid S. Knyshov (Aug 25)
- Re: Webmail.bellsouth.net security problems Marc Slemko (Aug 25)
- Re: Webmail.bellsouth.net security problems Edward S. Marshall (Aug 25)
- Re: Webmail.bellsouth.net security problems Kragen (Aug 25)
- [paul () boehm org: [cert-advisory () cert org: CERT Summary CS-98.07]] Paul Boehm (Aug 26)
- [djb () redhat com: Unidentified subject!] Paul Boehm (Aug 26)
- SV: Serious Security Hole in Hotmail Jonathan James (Aug 26)
- Re: Webmail.bellsouth.net security problems Joe (Aug 28)
- [SECURITY] Seyon is vulnerable to a root exploit Martin Schulze (Aug 28)
- Update on Linux unfsd Olaf Kirch (Aug 29)
- Buffer overflows in Minicom 1.80.1 Eduardo Navarro (Aug 29)
- Re: Buffer overflows in Minicom 1.80.1 Alan Brown (Aug 29)
- Re: Buffer overflows in Minicom 1.80.1 M.C.Mar (Aug 31)
- Re: Serious Security Hole in Hotmail Jeff Mcadams (Aug 25)