On Fri, Feb 06, 2004 at 07:28:18PM +0100, Stefan Esser wrote: > a) people write passwords into their URLs (valid point) > (but if they cannot write it into URLs they will store it into > IE password remembering function or attach some notes to their > monitor, so removing this feature has NOT improved security)
Yes it has. The contents of MSIE's rembering function and even notes on the monitor are not sent over the public internet in cleartext or recorded in server access (or, worse, referer, if the browser is sufficiently simple-minded) logs. It hasn't completely fixed security, but it has improved the situation somewhat. -- The freedoms that we enjoy presently are the most important victories of the White Hats over the past several millennia, and it is vitally important that we don't give them up now, only because we are frightened. - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html