[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Remailer Security
At 11:06 PM 03/04/96, [email protected] wrote:
>Bottom line: if you can crack (say) the 8-character Unix passphrase for a
>remailer account, you have full access to the remailer's secrets and all the
>opportunities that presents. Good remailer account passphrases are
>important.
Um, there's no reason why your remailer's account needs to be logged into
interactively, is there? Seems like remailer ops should disable login to
remailer accounts, putting '*' into the password field in /etc/passwd, or
however unix lets you disable login (I know it does).
Obviously, the general security risk of someone gaining unauthorized access
to the remailer executable or data files is still there, and important to
keep in mind. But this would seem to be a fairly logical security measure.