Re: MS to stop allowing passwords in URLs

From: Nick FitzGerald (nick_at_virus-l.demon.co.uk)
Date: 02/06/04

  • Next message: Himeur Nourredine: "formmail (PHP) Upload file using CSS" 
    Date: Fri, 06 Feb 2004 17:01:20 +1300
To: bugtraq@securityfocus.com

    "Dave Warren" <dave.warren@devilsplayground.net> wrote:

    <<big snip>>
    > It's probably too late, but rather then removing user:password support
    > altogether, maybe Microsoft could replace it with a dialog that informs the
    > user they are about to visit "session-arhuz.ru" with the username
    > "www.herbank.com", and an appropriate warning about not revealing sensitive
    > information, blahblahblah?

    Yeah, just like the "The doument you are opening contains macros or
    customizations. Some macros may contain viruses that could harm your
    computer. [...]" warnings prevented Word macro viruses...

    A user naïve enough to click on such a link does, in some important
    sense, _want_ to visit that page. Your suggested warning is just
    another thing that such users see as "getting in the way of doing what
    I want to do". Therefore, if implemented it would become more part of
    the problem than the solution (as users will become ever more familiar
    with ignoring "warnings" and clicking through them). If you understand
    users, you will know that in helping them to not shoot themselves in
    the feet, the only useful appraoch is to remove everything capable of
    firing the bullets (and quite a few things beside!)...

    On the Word macro virus front, things got notably better _NOT_ when MS
    implemented the above warning (that the users could blithely ignore and
    even _disable_ right there on the warning dialog -- what a travesty of
    mis-design that was!) but when it released a version of Word that
    defaulted to not running macros unless they were signed with an
    acceptable (as configured by the user/admin) key (there are legion
    flaws in the design of this feature, but it was strong enough to
    significantly impact the Word macro virus problem). In IE, removing
    support for this mis-feature (read RFC 2616) will have a much greater
    impact than trying to "direct" users who don't want to be directed with
    "warnings" and other stuff that "gets in their way". 

    -- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854
  • Next message: Himeur Nourredine: "formmail (PHP) Upload file using CSS"

    Relevant Pages

    • Re: Would Like LOG file to Record Shutdown
      ... from the delayed shutdown but it still takes 1-1/2 mins to complete. ... see Help and Support Center at ... I don't get any Errors or Warnings other than 3 IMAPI ... The Alerter service notifies users of administrative alerts on a network. ...
      (microsoft.public.windowsxp.help_and_support)
    • RE: Problems with the SQL Server Database Project when truncating
      ... Visual Studio reports this error because in some situations people do not ... want that the database change will cause loss of data. ... if you have chosen to treat warnings as errors. ... Microsoft Online Community Support ...
      (microsoft.public.vsnet.enterprise.tools)
    • Re: [alsa-devel] [PATCH] Support NVIDIA 8 channel HDMI audio
      ... I run scripts/checkpatch.pl on the new patches, it looks ok, it has 0 errors and 0 warnings. ... [PATCH] Support NVIDIA 8 channel HDMI audio ...
      (Linux-Kernel)
    • Re: BlueScreen
      ... node there are some warnings and some errors. ... and in Help And Support it's description is "An ... If I change the CD-ROM will I fix the problem? ...
      (microsoft.public.windowsxp.hardware)
    • RE: Run time error 75
      ... It sounds like to me that you're having problems with a Word macro. ... Microsoft Online Community Support ... You can send feedback directly to my manager at: ... nature are best handled working with a dedicated Microsoft Support Engineer ...
      (microsoft.public.scripting.vbscript)
    • Quantcast