[117318] in Cypherpunks
Re: Hotmail Accounts Exposed to All
daemon@ATHENA.MIT.EDU (David Wagner)
Tue Aug 31 13:02:58 1999
To: cypherpunks@cyberpass.net
From: daw@cs.berkeley.edu (David Wagner)
Date: 31 Aug 1999 09:24:32 -0700
Message-ID: <7qgvk0$hl0$1@blowfish.isaac.cs.berkeley.edu>
Reply-To: daw@cs.berkeley.edu (David Wagner)
In article <19990831103154.A426@weathership.homeport.org>,
Adam Shostack <adam@homeport.org> wrote:
> On Mon, Aug 30, 1999 at 03:33:46PM -0700, David Wagner wrote:
> | 1. If Hotmail had used a firewall, this should never have happened.
>
> "If Johnny had gone straight to the police, this never would
> have happened." Sorry, but I disagree with the usefulness of a
> firewall here. Code auditing was the missing piece. [...]
That's not my reading.
The bug I looked at (there seem to have been two, and I only saw the
"second" one) involved pointing your browser to a specific web site.
That site appears to have been a test site which does not check passwords,
perhaps for internal development use. (Without more information from
Hotmail, we can only speculate, but the hostname had "test" in it, as
did several others that worked similarly.)
Any firewall, no matter how simplistic, even a packet filter, should be
able to prevent internal test sites from being exposed to the outside world.
> [...] Code auditing was the missing piece. [...]
As far as I can tell, this doesn't appear to have been an error in code;
it seems to have been an error in procedure. (Again, same caveats: this
is just speculation from the outside.)
I'm glad to be pointed to some better interpretation, though...
> Unfortunately, no program I'm aware of requres adherence to
> the certifier's privacy statement [...]
Wow! I've never knew that. This is an amazing enough statement to stand
on its own.
I had some correspondence with TRUSTe. The person there stood on the
difference between security and privacy. If they don't even have enough
leverage to revoke certification for failing to adhere to the privacy policy,
I can imagine security would be an even more unlikely battle to win.
The TRUSTe person did note that Hotmail's privacy policy promised that
"profile information collected by Hotmail is stored in a secure operating
environment not accessible to the public". Oops...
