Now your talking about hackers instead of spammers. It is hard to
sniff a HTTP session, you have to penetrate your victim's network
enough to be able to do so. I really doubt a spammer would spend all
the time it would take to penetrate your network, parse though gigs of
http session dumps, just to be able to spam from one account or
server. Even if they did go though all this trouble, most email
accounts have quotas to prevent people from spamming with them.
And there are tons of SMTP servers which are configured to allow
plaintext authentication. You would also be surprised at the amount of
enterprise class software which store shared secrets in their
configuration files; look at Symantec's Altiris suite.
On May 13, 2008, at 6:45 PM, Jens Alfke wrote:
On 13 May '08, at 4:35 PM, Matt Burnett wrote:
Its not hard to enable HTTP authentication.
It's also not hard to eavesdrop on the HTTP session using tcpdump,
or to debug or disassemble the app to recover the password.
In other words, putting a shared secret into an application
distributed to end-users is not secure.
Probably not a realistic fear in this particular case, but there are
many, many instances of web scripts like this being abused to send
spam, so I don't think I'm being overly paranoid :)
—Jens
_______________________________________________
Cocoa-dev mailing list (Cocoa-dev@lists.apple.com)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com
This email sent to [EMAIL PROTECTED]
