Re: Insecure WWW Access Authorization Protocol?
Tony Sanders (sanders@BSDI.COM)
Wed, 9 Mar 1994 21:11:22 --100
michael shiplett <michael.shiplett@umich.edu> writes:
> 2) Mallet intercepts the request and sends to Alice:
> 401 Unauthorized
> Authenticate: KerberosV4 "http.mallet.evil.com@EVIL.COM"
> This is the critical step, because Mallet is able to control to
> which service Alice should authenticate herself.
Would someone please explain to me why a user would enter a password
at a prompt that read: "http.mallet.evil.com@EVIL.COM" (or anything
thing else they didn't recoginze?
Wouldn't they have to have a password for that realm and don't you
think they might think "gee, I don't have a password for that
realm".
What's missing from this picture?
--sanders