[33411] in bugtraq
Re: MS to stop allowing passwords in URLs
daemon@ATHENA.MIT.EDU (David B Harris)
Wed Feb 4 09:19:46 2004
Date: Tue, 3 Feb 2004 13:09:55 -0500
From: David B Harris <dbharris@eelf.ddts.net>
To: bugtraq@securityfocus.com
Message-Id: <20040203130955.6a00bdfe.dbharris@eelf.ddts.net>
In-Reply-To: <006401c3ea0f$f5b450f0$c800a8c0@nt.djw.biz>
Mail-Copies-To: nobody
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
On Mon, 2 Feb 2004 21:01:45 -0700
"Dave Warren" <dave.warren@devilsplayground.net> wrote:
> The safety concerns of http://user:pass@www aren't technical, they're
> user/training issues.. How do you explain to your grandmother that
> http://www.herbank.com:login.asp@session-arhuz.ru/ isn't safe but
> http://www.herbank.com/login.asp?arhuz.ru/ is okay?
>
> The solution, in my opinion, would be to come up with a new notation that
> doesn't break existing RFCs, but that still places the hostname first.
Or, hey, a different on-screen representation? Something like, I dunno,
"http://user:pass@site/" being turned into "http://site/ (user: user,
password: pass)"?
If you're worried about anything *other* than either the URL bar or the
status bar (like, for instance, the descriptive text of the link),
you're out of luck anyways. People who would still fall for that will
also fall for <a
href="http://www.please-crack-me.ru">http://www.microsoft.com</a>
Seriously, KISS. ("Keep It Simple, Stupid" for those who either aren't
familiar with the jargon or aren't native English speakers ;)
