Full Disclosure mailing list archives
Re: Filezilla's silent caching of user's credentials
From: dave b <db.pub.mail () gmail com>
Date: Sun, 17 Oct 2010 13:52:39 +1100
On 17 October 2010 01:46, Jeffrey Walton <noloader () gmail com> wrote:
Am I the only person who finds it ironic that the same measures leveraged against closed source projects have to be employed against some open source projects?Yet another example, complete with a public pissing contest: "XSS in Squirrelmail plugin 'Virtual Keyboard'", http://seclists.org/fulldisclosure/2010/Oct/45
XSS are lame but they can be used to steal your email, money from your bank, administrative password to systems.... etc. [0] If you get pwned by lame, you still are pwned.
As was noted in a previous list mailing:This is an alarming trend in open source software, and diametrically opposed to the claims of "more eyes equates to more secure"", "open source software is more secure", and "open source software fixes bugs faster than other software models".
Open source != good. What makes open source projects successful is the people usually want to contribute and are *involved*. "Real quality means making sure that people are proud of the code they write, that they're involved and taking it personally. " Linus. We are all human so ... get over this open source is $better/$worse than proprietary code. We can submit patches to open source projects, they might not be accepted. With proprietary software you can't see how crap component X really is (codewise) but usually it will show up in use. The real problem is a lack of awareness in the value of testing code. Test things that should *fail*, that should *pass* and that shouldn't *work*. Also, remember you are not testing code for the sake of validation, but so you know the behaviour of your system matches what you expect.
"I do not see any harm in storing credentials as long as the rest of your system is properly secure as it should be." Source:(http://forum.filezilla-project.org/viewtopic.php?f=3&t=17932) [SNIP]
This is always an issue... how do you keep passwords? You can 'encrypt them' but to get access they have to be decrypted. How good should the protection be... imho desktop keychains are better than in-app level storage. In most cases no amount of 'protection' will protect a system which has been owned by an attacker. [0] https://blogs.apache.org/infra/entry/apache_org_04_09_2010 -- I do desire we may be better strangers. -- William Shakespeare, "As You Like It" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Filezilla's silent caching of user's credentials Ryan Sears (Oct 07)
- Re: Filezilla's silent caching of user's credentials Michael Wood (Oct 07)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 07)
- Re: Filezilla's silent caching of user's credentials Hurgel Bumpf (Oct 08)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 08)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 16)
- Re: Filezilla's silent caching of user's credentials dave b (Oct 16)
- Re: Filezilla's silent caching of user's credentials coderman (Oct 21)
- Re: Filezilla's silent caching of user's credentials Christian Sciberras (Oct 26)
- Re: Filezilla's silent caching of user's credentials Jeffrey Walton (Oct 16)
- Re: Filezilla's silent caching of user's credentials Vipul Agarwal (Oct 09)
- Re: Filezilla's silent caching of user's credentials Brandon McGinty (Oct 11)
- Re: Filezilla's silent caching of user's credentials rdsears (Oct 11)
- Re: Filezilla's silent caching of user's credentials Mutiny (Oct 13)
- Re: Filezilla's silent caching of user's credentials Chris Evans (Oct 13)