<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<a class="moz-txt-link-abbreviated" href="mailto:tnt@kalik.net">tnt@kalik.net</a> wrote:
<blockquote cite="mid:ef5ZgSpN.1229548147.9573870.tnt@kalik.net"
type="cite">
<blockquote type="cite">
<pre wrap="">What could a hacker do to the server if he can't even get passed returning a
correct shared secret?
</pre>
</blockquote>
<pre wrap=""><!---->
Get the usernames and passwords of your users and gain access to your
network at will. Publish them and let anybody use your network.
</pre>
</blockquote>
<br>
Internet for free. Sounds great. Here's one example, is this you?<br>
<br>
Geier, Eric <a class="moz-txt-link-abbreviated" href="mailto:me@egeier.com">me@egeier.com</a><br>
297 Marchmont Drive<br>
Fairborn, Ohio 45324<br>
United States<br>
+1.9372600286<br>
<br>
First Google hit:<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.informit.com/authors/bio.aspx?a=AFEDE263-5156-4C97-AD8E-5E4473511557">http://www.informit.com/authors/bio.aspx?a=AFEDE263-5156-4C97-AD8E-5E4473511557</a><br>
<br>
Interesting list of books on your site.<br>
<pre wrap="">"Say I did open up to any IP, the AP's MAC must match one from my list;
moreover the hacker must have the shared secret. Plus if I can add to the
example SQL statement, I would add to the WHERE clause "and domain =(domain
pulled from what's after the username's @ sign). Then the hacker must know a
username and domain that matches an acceptable AP, the user's password, that
acceptable AP's MAC address, and then finally the shared secret for the AP. "
So, because a lot of hurdles are put in front of someone that should stop them? If so, I would never be where I am today. All that does is challenges your adversaries intellect, and let us face reality a bit, the ones that knows what they do would take that challenge on any day. Put a carrot in front of a donkey, and it'll get eaten. Put a lot of carrots in front of the donkey and they'll still get eaten, it'll just take slightly longer.
I can't see how putting your authentication and authorization system in the wild will help you, other than saving a buck on setting up VPNs between your sites. Which can also be done cheaply if cost is the motivator.
Don't put an infrastructure piece like this sit in the open if you use it for your internal purposes. Wouldn't you agree?
//anders</pre>
</body>
</html>