Re: [Security] About the Firefox 3 Security Dialog & others

[Jonathan Schleifer]

m 23.08.2008 um 00:20 schrieb Dirk Meyer:

Woudln't that mean an attacker could chose the question and chose one
to which he knows the answer because it's not so secret? If an

question. Correct me if I'm wrong.

attacker does that with both ends, he has won, because he selected the

No correction, you are right. The riddle is a stupid idea.

--
Jonathan

So we should go for SAS, I think. Having a 32-bit SAS encoded with Mnemonics (like already suggested here) really sounds like a great idea. I'd even prefer that to the way it's done in ESessions now :þ.

PGP.sig
Description: This is a digitally signed message part