I read the paper and I missed the quote about Slash security that the AC refers to. But, the paper does say the following:
So assuming a user actually changes his or her password, Slash 2.0 actually does a decent job of obfuscating it in a cookie with MD5 encryption. In terms of account lock out, the Slash distribution also includes a script to aid in IP address banning for suspicious brute-force behavior.
Great artical! (Score:0)
They actually say:
"Slash's security is weak. It is so bad that one would think it was created by Microsoft"
Can't find that juicy quote (Score:1)
--
Dave Aiello
Chatham Township Data Corporation [ctdata.com]
Re:Can't find that juicy quote (Score:2)
Re:Can't find that juicy quote (Score:1)
The correct terminology is YHBT.. Imagine that. :-P
(And no, that AC wasn't me.)
One future, two choices. Oppose them or let them destroy us.
Parent