Re: [Full-disclosure] sans handler gives out n3td3v e-mail to public

2008-03-23 Thread taneja . security
I think this the most worst and alarming situation ..where SANS like organization is doing the way.. from onwards no body will report info to SANS... E+1 t+1 b+1 j+1 it OFF!!! On 3/23/08, n3td3v [EMAIL PROTECTED] wrote: On Fri, Mar 21, 2008 at 8:14 PM, atlas [EMAIL PROTECTED]

[Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Steven Rakick
Hello list, I'm curious what the group thinks about the recent surge in support for OpenID across the web and the impact it will have. 1) Beemba - http://www.beemba.com 2) ClaimID - http://www.claimid.com 3) MyOpenID - http://www.myopenid.com 4) Many others... These sites are gaining in

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Paul Schmehl
--On Sunday, March 23, 2008 5:18 AM -0700 Steven Rakick [EMAIL PROTECTED] wrote: Hello list, I'm curious what the group thinks about the recent surge in support for OpenID across the web and the impact it will have. 1) Beemba - http://www.beemba.com 2) ClaimID - http://www.claimid.com

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread fabio
There're more complications: who owns/controls the service can track down your movements between different webplaces, profiling your common habits/preferences. How long before banners will follow your navigation trough different websites where you use the same identity token? CtrlAltCa Paul

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Kern
OpenID represents (at least to the OSS world) the unified login structure that has been the proprietary advantage of Microsoft for so long. This will be an excellent technology for business to use internally (who control their own servers and services). It allows the capabilities of Single Sign

[Full-disclosure] [ MDVSA-2008:075 ] - Updated bzip2 packages fix denial of service vulnerability

2008-03-23 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:075 http://www.mandriva.com/security/

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Petko D. Petkov
Hi Steven, I guess most 1337 hax0rs will flame you on this list. There are good security blogs you can follow and learn from instead. Full-disclosure is for rants and bashing only! I can point you to some articles that I wrote regarding OpenID, however, let me share my thoughts quickly as that

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread reepex
thats right pdp - go run to your protected lists and blogs where you don't have to hear anything negative and where you can flame people without contest who talk against you. you are another Bill O Reilly and everyone thinks of you as such. enjoy your sheep. On Sun, Mar 23, 2008 at 9:52 AM,

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Paul Schmehl
--On March 23, 2008 2:52:53 PM + Petko D. Petkov [EMAIL PROTECTED] wrote: First of all, OpenID is a very simple but rather useful technology. With OpenID you have only one account, your ID, which you can use everywhere where the OpenID technology is supported. It is not clear whether

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Larry Seltzer
It's worth pointing out that some OpenID providers are better than others. An OpenID provider could implement 2-factor authentication, and some have (http://www.infrastructure.ziffdavisenterprise.com/c/a/Blogs/OpenID-In-H ardware/), or other features which could strengthen it. Larry Seltzer

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Steven Rakick
Many of you have brought up that OpenID is vulnerable to phishing and have highlighted weaknesses specific traditional username/password authentication. This was the main reason I bought up Information Cards in my original post. I've noticed that Beemba (http://www.beemba.com) and MyOpenID

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Paul Schmehl
--On March 23, 2008 4:16:28 PM -0700 Steven Rakick [EMAIL PROTECTED] wrote: Many of you have brought up that OpenID is vulnerable to phishing and have highlighted weaknesses specific traditional username/password authentication. This was the main reason I bought up Information Cards in my

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Paul Schmehl
--On March 23, 2008 7:20:55 PM -0400 Larry Seltzer [EMAIL PROTECTED] wrote: It's worth pointing out that some OpenID providers are better than others. An OpenID provider could implement 2-factor authentication, and some have

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Kurt Buff
On 3/23/08, Larry Seltzer [EMAIL PROTECTED] wrote: I understand the attractiveness of not having to remember lots of IDs and passwords, but when you give up control of your data, you give up control of your future. Normal people aren't going to remember enough passwords, let alone strong

Re: [Full-disclosure] OpenID. The future of authentication on the web?

2008-03-23 Thread Steven Rakick
I'm not sure why it isn't on their home page any more. It used to be. Their FAQ is at: http://www.beemba.com/faq.aspx. On Sun, Mar 23, 2008 at 8:46 PM, Paul Schmehl [EMAIL PROTECTED] wrote: --On March 23, 2008 8:04:41 PM -0400 Larry Seltzer [EMAIL PROTECTED] wrote: I understand the