[Tools-team] Agenda for the 14 June 2006 Teleconference

Henrik Levkowetz writes:
> 2. Status review
> 
>    * Dashboard
> 	- Henrik

Some comments about loginmgr.

1) That login manager really needs to require TLS protection, i.e
   mandate that both the forms and the posts are always using TLS.

2) The URL for changing password should only work exactly once, not
   for 24 hours. The problem with 24 hours is that if someone manages
   to get the URL later from my mailbox or some other place he can
   change my password after I changed it. If it works exactly once,
   either I will get error that password has already been changed
   using the URL (i.e. I know there was attacker who stole my URL) or
   the attacker cannot change my password after I have successfully
   changed it. Perhaps storing the used auth sha1sum to some directory
   and checking that it cannot be there before continuing.
-- 
kivinen@safenet-inc.com

_______________________________________________
Tools-team mailing list
Tools-team@ietf.org
https://www1.ietf.org/mailman/listinfo/tools-team