Re: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-28 Thread Cael Abal
Zach Forsyth wrote: And for people saying don't use IE, if you aren't the sole admin on the server you don't have the choice to install other apps. Believe me if I could install something else I would just put a real ftp app and firebird on there and not have to ask silly questions on FD. Please

RE: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-28 Thread Kenton Smith
On Tue, 2004-01-27 at 21:36, Zach Forsyth wrote: After reading through the MS advisory in more detail it doesn't actually mention ftp at all. This was kindly pointed out by several FD readers :) I will wait and see if the patch just fixes http and https before worrying about it in earnest.

Re: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-28 Thread Daniel . Capo
What I'd like to know is if they'll do this IN ADDITION to fixing the bug or not. Bobby Brown wrote: Summary Microsoft plans to release a software update that removes support for handling user names and passwords in HTTP and HTTP with Secure Sockets Layer (SSL) or HTTPS URLs in Microsoft

Re: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-28 Thread Nick FitzGerald
Cael Abal [EMAIL PROTECTED] wrote: Please tell me you don't do a lot of web browsing from your server. IE being required on a Windows server (for SUS management, etc.) is one of my pet peeves -- but folks who browse the internet from their server actively freak me out. (This isn't

RE: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-28 Thread Ron DuFresne
[SNIP] This is being asked in all seriousness and helpfulness... Do you have access to a command line? You could the command line FTP, it's way better than IE. STOP! You'll confuse all those MCSE's out there that have learned, rather then a tool to fit the job, use the

RE: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-27 Thread Zach Forsyth
Great solution :( Love the MS way of fixing things... It fixes url obfuscation somehwat but doesn't this break ftp functionality in IE when behind a firewall? If you type in ftp.mysite.com or whatever, IE automatically logs you in using anonymous credentials. If the site allows anonymous logins

Re: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-27 Thread Thomas Frenzel
It fixes url obfuscation somehwat but doesn't this break ftp functionality in IE when behind a firewall? According to the article this modification pertains http and https url-schemes, wich appears to be rfc-conformably to me. I would not expect the ftp-scheme and others to be affected. Thomas

Re: [Full-Disclosure] Microsoft's fix for URL containing username:password@ obfuscation

2004-01-27 Thread George Capehart
On Tuesday 27 January 2004 09:47 pm, Zach Forsyth wrote: snip Anone know a workaround to tell IE not pass anonymous credentials automatically? Don't use IE. Use Camino, Opera, Netscape, Mozilla, Firebird, or, God forbid, ftp . . . -- George Capehart capegeo at opengroup dot org PGP Key