[117319] in Cypherpunks
Re: Hotmail Accounts Exposed to All
daemon@ATHENA.MIT.EDU (Adam Shostack)
Tue Aug 31 13:10:45 1999
Date: Tue, 31 Aug 1999 13:14:29 -0400
From: Adam Shostack <adam@homeport.org>
To: David Wagner <daw@cs.berkeley.edu>
Cc: cypherpunks@cyberpass.net
Message-ID: <19990831131428.B1545@weathership.homeport.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <19990831103154.A426@weathership.homeport.org>; from Adam Shostack on Tue, Aug 31, 1999 at 10:31:55AM -0400
Reply-To: Adam Shostack <adam@homeport.org>
On Tue, Aug 31, 1999 at 10:31:55AM -0400, Adam Shostack wrote:
| On Mon, Aug 30, 1999 at 03:33:46PM -0700, David Wagner wrote:
| | Yes. Two other tidbits that I haven't seen reported yet:
| | 1. If Hotmail had used a firewall, this should never have happened.
| | The media have been talking about the importance of firewalls
| | for years; what went wrong at Hotmail?
| "If Johnny had gone straight to the police, this never would
| have happened." Sorry, but I disagree with the usefulness of a
| firewall here. Code auditing was the missing piece. A good firewall
I misunderstood the bug; I thought that the cgi request could be sent
to any hotmail server and get a response, Dave informed me that it was
a group of test servers that exhibited the behavior. I stand
corrected.
Adam
--
"It is seldom that liberty of any kind is lost all at once."
-Hume
