[39545] in Cypherpunks
Re: NYT on Netscape Crack
daemon@ATHENA.MIT.EDU (Michael Shields)
Wed Sep 20 02:52:29 1995
From: shields@tembel.org (Michael Shields)
To: sameer@c2.org (sameer)
Date: Wed, 20 Sep 1995 06:48:09 +0000 (GMT)
Cc: rjc@clark.net, sameer@c2.org, perry@piermont.com, cypherpunks@toad.com
In-Reply-To: <199509190748.AAA03614@infinity.c2.org> from "sameer" at 1995-09-19 00:48:05
> The server process itself still needs access to that file
> though in order to verify passwords, so it can't be totally
> protected-- a bug in the server might reveal the password file. A
> relatively minor point..
Actually, it could communicate with a differently-privileged process.
The security gain probably isn't worth the performance hit, though.
(A possible secure channel: Give the password manager a uid of its own.
Have it listen on a unix-domain socket. The server process opens the
socket, then fstat()s it to make sure it's really owned by the password
manager.)
--
Shields.
