[nafex] NAFEX security

Claude Jolicoeur cjoli at gmc.ulaval.ca
Sat Dec 1 12:35:29 EST 2012


You are totally right, Al.
But hopefully, most will have done like me, and 
just leave this automatically generated password 
there for the list, knowing that, in the unlikely 
eventuality I ever need it, I can retrieve it from this email!
Cheers,
Claude

Le 12:20 12.12.01, vous avez écrit:
>Hello all,
>
>I actually READ the monthly update that
>ibiblio.org sends out each month about the
>list, and I was unpleasantly surprised to see
>that the email includes both my email address
>and password.
>
>I have professional experience in I.T.
>security, and this is a very old behavior
>that is considered a worst-practice by
>today's standards.
>
>_I strongly recommend that all of you create
>a password that you use exclusively for
>ibiblio.org lists until they change their
>practice._
>
>Very bad (and very smart) people sit on the
>Internet and harvest these kinds of emails,
>and it's not at all difficult to grab the
>entire batch in one swoop and harvest all of
>the email accounts and passwords.
>
>_How many of you have one password for
>everything?_  I thought so...
>
>The bottom line is that the bad guys can
>search for matches with vendors, and try out
>your NAFEX password to buy on your behalf.
>That, or they hijack your email account and
>use it to spam your friends.
>
>It's that simple.
>
>No sense having a complicated password when
>ibiblio.org emails it to the world.
>
>I could go on about how it's also bad that
>ibiblio.org actually has access to your
>password, but why belabor the point...
>
>_Anyway, change your password to something
>unique to NAFEX unless you're a risk taker_.
>
>Al Yelvington
>Russell, PA



More information about the nafex mailing list