Re: Apparently the practice was prevalent

[Stefan Esser <s.esser () e-matters de>]

It is unbelievable that the media is spreading such FUD about the
URL passwords.

The URL passwords are as secure as HTTP-Auth, because they are just
a way to tell the browser what HTTP-Auth l/p combination should be
used. The URLs as they are get NEVER transmitted through the internet
in that form.

Well except you send the link by email, im, whatever. But this is
a stupid argument, because that is equal to sending the link without
the u/p and telling it the person in the next sentence of your mail.

The only good thing in this article is the message, that it breaks
thousands of applications and produces tons of unnecessary costs.
Well and it is now impossible to get HTTP URLs that are protected
by HTTP-Auth mechanism. The APIs are not designed to provide
username/password combinations in another way. 

If it improves security that people cannot use password protected
directories anymore... I doubt, I doubt.

Stefan

-- 

--------------------------------------------------------------------------
 Stefan Esser                                        s.esser () e-matters de
 e-matters Security                         http://security.e-matters.de/

 GPG-Key                gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 
 Key fingerprint       B418 B290 ACC0 C8E5 8292  8B72 D6B0 7704 CF6C AE69
--------------------------------------------------------------------------
 Did I help you? Consider a gift:            http://wishlist.suspekt.org/
--------------------------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html