Re: [Full-Disclosure] SMC Router safe Login in plaintext

From: Kim Scarborough (kjsat_private)
Date: Wed Sep 03 2003 - 14:41:47 PDT

  • Next message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:240-01] Updated httpd packages fix Apache security vulnerabilities"

    > Every ISP I've ever dealt with stores your password in plaintext.  If this 
    > were not true, they would not be able to tell you what it is.
    
    I've worked tech support at two ISPs and known many people who have worked at
    others. I've never heard of an ISP that stored passwords in plaintext.
    
    > The risk is that someone else could use your account to access the 
    > Internet.  Apparently that's a risk the ISPs are willing to take.  So 
    > exposing your ISP password in plaintext on your own computer is really no 
    > more of a risk than you are already exposed to.
    
    That's a silly thing to say. Even if there are a couple ISPs out there that
    store passwords in plaintext, it's hardly the norm, and it's foolish to base
    your own habits on that assumption.
    
    -- 
    ----------------------------------------------------------------------------
    Kim Scarborough                                  Web Systems Administrator
    University of Chicago/NSIT                       (773) 834-7740
    ----------------------------------------------------------------------------
    Now listening to: Kanuni Garbis - "Ninno Yavrum"
    ----------------------------------------------------------------------------
    
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    



    This archive was generated by hypermail 2b30 : Wed Sep 03 2003 - 16:40:24 PDT