Date: Sat, 19 Jan 2002 14:15:26 +0000 From: Mark Murray <mark@grondar.za> To: "Andrey A. Chernov" <ache@nagual.pp.ru> Cc: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org Subject: Re: cvs commit: src/lib/libpam/modules/pam_opie pam_opie.c Message-ID: <200201191415.g0JEFQt21503@grimreaper.grondar.org> In-Reply-To: <20020119105418.GA7683@nagual.pp.ru> ; from "Andrey A. Chernov" <ache@nagual.pp.ru> "Sat, 19 Jan 2002 13:54:19 %2B0300." References: <20020119105418.GA7683@nagual.pp.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Sat, Jan 19, 2002 at 10:47:08 +0000, Mark Murray wrote: > > > ache 2002/01/19 02:09:05 PST > > > > > > Modified files: > > > lib/libpam/modules/pam_opie pam_opie.c > > > Log: > > > If user not exist in OPIE system, return failure immediately instead > > > of producing fake prompts with random numbers which can be detected by > > > potential intruder in two tries and totally confuse non-OPIE users. > > > > I object to this. The better way is to produce fake but (semi-) constant > > challenge. > > It is impossible. Crap. > 1) How do you plan to identify intruder to keep choosed semi-constance for > him? It is not based on the intruder. There are lots of ways to do it. One way is to hash on the month and the uid or username of the account being attacked. This will change on midnight at the end of the month, but that exposes very little. > 2) S/Key and OPIE was designed to not interfere normal users processing, > only incorrectly written applications use those fake promts. Fake promtps > may cause not user confusion only but seriosly affects protocols which not > expect them. If the protocol is not expecting them, but the user has them enabled, you have a problem anyway. M -- o Mark Murray \_ FreeBSD Services Limited O.\_ Warning: this .sig is umop ap!sdn To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200201191415.g0JEFQt21503>