[2325] in Kerberos
Re: kerberizing xlock ???
daemon@ATHENA.MIT.EDU (Greg Wohletz)
Sat Oct 31 00:03:45 1992
To: Barry Jaspan <bjaspan@Athena.MIT.EDU>
Cc: hendrick@neptune.ctron.com, kerberos@Athena.MIT.EDU
In-Reply-To: Your message of "Fri, 30 Oct 92 16:23:58 EST."
Date: Fri, 30 Oct 92 20:57:58 -0800
From: Greg Wohletz <greg@duke.cs.unlv.edu>
>If I can create a fake tgt response from Kerberos, then presumably I
>can create a fake service ticket response from Kerberos, *and* I can
>fake a response from the verification service you propose. Thus I can
>still fake out the login program on the attacked host.
Um, doesn't that require you to know the verification processes password?
--Greg
