Re: TinyURL

[Troy <th () zeno com>]

On Wed, 29 Oct 2003 14:44:12 -0700, "Joel R. Helgeson" <joel () helgeson com> wrote:

> Who cares about credit card numbers, I'm looking for privileged access to
> sites.  Consider the following:
>
> People use this service as an attempt to obfuscate the usernames and
> passwords to protected websites and ftp servers that they email out.  I'm
> finding a lot of urls that read like:
> http://username:password () www protectedsite com/members
> ftp://user:pass () ftp securedftp com/private/sourcecode
>
> Looks like they wanted to get someone into their site, but didn't want to
> actually 'give' the username and password out, so they tinyurl'ed it.
>
> This means they've posted their username and password to the entire web!!

True, but even that seems like a lot of work when you can head to IRC
and get loads of passwords for a lot less effort.

I do agree that a disclaimer and warning on these sites is somewhat
important. In fact, it wouldn't take much code to have it look at the
URL, decide it if probably contains sensitive information, and make the
user confirm that they still want to use the service.

-- 
Troy

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html