There is a claim of a password crack against OAuth, OpenID, and related software libraries.
http://bit.ly/b4Wh6S+ (Computerworld) http://www.computerworld.com/s/article/9179224/Researchers_Authentication_cra ck_could_affect_millions This is important, of course, particularly because of the use of OAuth and OpenID as a kind of SSO, and therefore a single-point-of-failure against all kinds of systems. However, I wonder if there is also a relation to the recent spate of SSH attempts that has been reported in some circles? One reported "fix" was to use certificates rather than passwords, but that may be exactly what the attacks are trying to hit. ====================== (quote inserted randomly by Pegasus Mailer) rsl...@vcn.bc.ca sl...@victoria.tc.ca rsl...@computercrime.org The earth is degenerating these days. Bribery and corruption abound. Children no longer mind parents. And it is evident that the end of the world is fast approaching. - Syrian tablet, 2800 BC victoria.tc.ca/techrev/rms.htm blog.isc2.org/isc2_blog/slade/index.html http://blogs.securiteam.com/index.php/archives/author/p1/ http://www.infosecbc.org/links http://twitter.com/rslade _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
