Re: [Full-Disclosure] Re: Multiple issues with Mac OS X AFP client

2004-03-05 Thread petard
On Fri, Mar 05, 2004 at 12:49:57AM +0100, Stefan Bethke wrote: > >SecureMac.com has a article on this if anyone is interested. > > Is that so? Google didn't seem to find much... Your google-fu must be weak. OP was correct about password storage, and google does indeed turn up articles about that

[Full-Disclosure] Re: Multiple issues with Mac OS X AFP client

2004-03-04 Thread Stefan Bethke
Am 04.03.2004 um 04:34 schrieb Marukka: Nice find. Most people really shouldn’t be using AFP. I know that Classic MacOS machines store the passwords on disk using a simple XOR cipher. Any local storage of passwords is only as secure as the security of the key store. The lack of sophistication i

[Full-Disclosure] Re: Multiple issues with Mac OS X AFP client

2004-03-03 Thread Marukka
Nice find. Most people really shouldn¹t be using AFP. I know that Classic MacOS machines store the passwords on disk using a simple XOR cipher. I would assume that they also transmit the password using the same cipher. SecureMac.com has a article on this if anyone is interested. "The ACLU (American

Re: [Full-Disclosure] Re: Multiple issues with Mac OS X AFP client

2004-02-27 Thread KF
Their non confirm / non deny policy kinda makes it difficult to talk about security stuff anyway... -KF Chris Adams wrote: On Feb 27, 2004, at 9:24, Chris Adams wrote: Multiple issues with Mac OS X AFP client Vendor Response: None After some discussion with someone on Apple's product se

[Full-Disclosure] Re: Multiple issues with Mac OS X AFP client

2004-02-27 Thread Chris Adams
On Feb 27, 2004, at 9:24, Chris Adams wrote: Multiple issues with Mac OS X AFP client Vendor Response: None After some discussion with someone on Apple's product security team it turns out that I was responsible for the lack of response - my original notice went to Apple corporate security rat