Re: [apps-discuss] Webfinger discussion

[Andrew Sullivan <[e-mail]>]

On Mon, Mar 26, 2012 at 10:35:54AM -0400, Paul E. Jones wrote:

> > Andrew Sullivan: when I was a kid, they told us to turn off finger, so I'm
> > concerned about security
> 
> That was due to the fact the finger protocol implementations had security
> holes.  It was also possible to do things like "ln /etc/password .plan" and
> that was a bad thing :-)

That wasn't the only reason they told us this.  One of the things that
people used to worry about was that finger leaked information.  In
particular, it was an excellent way to identify targets for account
takeover: people who never logged in, and people who were in for
endless days and therefore whose account was probably often
unmonitored.

Now, I never knew whether I believed this sort of complaint, but it
was one, and the draft as it stands only just hints at the sort of
analysis that ought to be done.  It seems like this requires a much
expanded security considerations section, and that was the point I
wanted to make.

Best,

A

-- 
Andrew Sullivan
[e-mail]