[4518] in SIPB bug reports
Re: xscreensaver
daemon@ATHENA.MIT.EDU (Derek Atkins)
Fri Apr 1 17:24:18 1994
To: yandros@MIT.EDU
Cc: bug-sipb@MIT.EDU, Matt Braun <mhbraun@MIT.EDU>
In-Reply-To: [4517] in SIPB bug reports
Date: Fri, 01 Apr 94 17:23:37 EST
From: Derek Atkins <warlord@MIT.EDU>
> o make it use kerberos passwords. This makes xscreensaver more secure
> but is undesireable for other reasons (think `Trojan Horse').
This is bad because not only does it allow a Trojan Horse, but it also
allows a spoofer easy access to a machine, since cluster machines do
not have srvtabs, so there is no way to verify the user's password.
(I could spoof kerberos packets with a valid ticket encrypted with the
passphrase of my choosing).
-derek
