On Fri, 23 Feb 1996, Martin Fredriksson wrote:
> I agree to the basic idea that we should not distribute any information which
> could make it easier for the bad guys, but I also think that REAL security
> cannot depend on obscurity in this case. If the mail name is the same as the
> user account name, we need to make it very hard to mount an attack based on
> that information (e.g. by disallowing any login attempts, always using strong
> authentication, etc).
exactly, dont count on hiding login names providing any
additional protection. dont provide any unncessary information that may help
the outsiders.
References:
|
|
