Re: Re: HTTP AUTH BASIC monowall.

[Simon Smith <simon () snosoft com>]

Dave Korn wrote:
> Simon Smith wrote:
>   
> > Ok,
> >    As suspected... so I am correct; and it is a security threat. I can
> > compromise a network, arp poison it, MiTM, access the firewall,
> > distributed metastasis, presto... owned...
Responding to youw ill be fun...
]\
>   Utter garbage.  
are you from the UK?
> You haven't the faintest understanding of the concepts you 
> are throwing around.  Whatever you do, DO NOT issue a security warning based 
> on this thread, or you will look very foolish.
>   
Who ever said I was going to issue a security advisory or "warning" as
you called it? Why do so many people assume so many things?
>   ARP is no use except to redirect traffic WITHIN THE SAME LAN.  You can't 
> use it to redirect traffic across the internet-at-large.
>   
Gee, you must have missed the entire thread... who said internet?

>   A base 64 encoded string is not a hash.
>   
Ok I used the wrong term... been a long day... so sorry...

>   There's nothing wrong with BASIC AUTH.
>   
Aside from the fact that its... um... insecure?
>   Seriously, if you don't understand what arp is, how the layers of the OSI 
> stack interrelate, or what a hash is, you are fundamentally unaware of the 
> basic concepts of networking and security, how can you possible expect to 
> write a worthwhile security warning?
>   
Well, you are a good example. You don't write very good emails and you
aren't very well aware of the entire email thread now are you? I'll make
it a point to not be as silly as you. ;]

>     cheers,
>       DaveK
>   

AH you are from the UK, you said Cheers!


-- 


Regards, 
        Adriel T. Desautels
        Harvard Security Group
        http://www.harvardsecuritygroup.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/