4 ms·
It doesn't matter how you spin the verbiage. It's all just as bad.
by jasonlingx 14y ago
It doesn't matter how you spin the verbiage. It's all just as bad.
- runako 14y agoBeing accurate is not spinning. Accuracy matters, especially in matters of security. It's really not too much to ask for security alarmists to make precise claims.
- marshray 14y agoWould something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .
- jasonlingx 14y agoWebsites sending passwords in email should be alarming. You are trying to spin it as not necessarily alarming, which is false.