Full Disclosure mailing list archives
RE: HTTP AUTH BASIC monowall.
From: "Lyal Collins" <lyal.collins () key2it com au>
Date: Tue, 14 Mar 2006 10:52:55 +1100
I find a central issue that often reoccurs when discussing secure protocols is the definition of where the secure protocol starts and stops - the user, the application, or some underlying OS/functional library or network device? There are usually huge chasms between the business, legal and technical/security guru perspective on this - but in my experience these differences significantly influence purchase and implementation budget decisions. Lyal -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Jeremy Bishop Sent: Tuesday, 14 March 2006 10:40 AM To: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] HTTP AUTH BASIC monowall. On Monday 13 March 2006 15:17, Lyal Collins wrote:
Yup, that's right: All PKI authentication is only as good as the passwords protecting private keys where such passwords exist, and the complementary endpoint security controls.
<snip> I thought you might be meaning something like that. I would say that these problems are out of scope for a discussion of secure communication protocols. E.g. Alice is considered synonymous with her computer. Once you open up the possibility that Alice (or Bob) have been hacked, there's no real point to discussing how to secure her communications. But in a more pedantic sense, yes, you are correct. Jeremy -- Fix reason firmly in her seat, and call to her tribunal every fact, every opinion. Question with boldness even the existence of a god; because, if there be one, he must approve the homage of reason rather than of blind-folded fear. -- Thomas Jefferson, 1787 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: HTTP AUTH BASIC monowall., (continued)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- Re: HTTP AUTH BASIC monowall. Matthijs van Otterdijk (Mar 13)
- Re: HTTP AUTH BASIC monowall. Jeremy Bishop (Mar 13)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 13)
- Re: HTTP AUTH BASIC monowall. Jeremy Bishop (Mar 13)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 13)
- RE: HTTP AUTH BASIC monowall. Lyal Collins (Mar 13)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- RE: HTTP AUTH BASIC monowall. Lyal Collins (Mar 13)
- Re: HTTP AUTH BASIC monowall. Jeremy Bishop (Mar 13)
- RE: HTTP AUTH BASIC monowall. Lyal Collins (Mar 13)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- Re: HTTP AUTH BASIC monowall. Tim (Mar 13)
- Re: HTTP AUTH BASIC monowall. Pavel Kankovsky (Mar 13)
- Re: HTTP AUTH BASIC monowall. Keith (Mar 13)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 15)
- Re: HTTP AUTH BASIC monowall. Michael Holstein (Mar 15)
- Re: HTTP AUTH BASIC monowall. Valdis . Kletnieks (Mar 15)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 15)
- Re: HTTP AUTH BASIC monowall. Michael Holstein (Mar 15)
- Re: HTTP AUTH BASIC monowall. Simon Smith (Mar 15)
- Re: HTTP AUTH BASIC monowall. gboyce (Mar 15)