Re: Netscape Communicator 4.x sensitive informations in configuration file

From: mstoltzat_private
Date: Tue Mar 04 2003 - 11:21:00 PST

  • Next message: David Kennedy CISSP: "Re: BIND 9.2.2 Vulnerabilities?"

    
     ('binary' encoding is not supported, stored as-is)
    In-Reply-To: <3E5F651E.35B09C5Dat_private>
    
    >It seems that I'm one of the last Netscape 4.x users. 
    >The following paste shows the IMAP mail part of this
    configuration file.
    >You can see that the line 17 shows the unencrypted
    password
    
    Netscape 4.x is out of date - we recommend that
    everyone upgrade to our latest version, Netscape 7.02.
    In versions 6.1 and later, when the user chooses to
    store a password, it is saved by default in
    Base64-encoded format, but not encrypted. The user can
    choose to encrypt all stored passwords with a "master
    password" which acts as the key for a strong encryption
    algorithm (3DES or AES, I think).    To turn on the
    strong encryption, choose Preferences from the Edit
    menu. Open the "Privacy & Security" tab, click
    "Passwords," and check the box labeled "use encryption
    when storing sensitive data."
         -Mitch Stoltz
          Netscape Client Security & Privacy
    



    This archive was generated by hypermail 2b30 : Tue Mar 04 2003 - 13:31:48 PST