>>>>> "DW" == Dave Wolfe <dwolfe@risc.sps.mot.com> writes:
DW> I haven't studied the Majorcool source to see what sort of security
DW> problems it contains (no time for such games, that's the author's job
DW> :-) ), but from a quick peek at the posted URL, it appears that Mjcool
DW> side-steps the issue by disallowing all sorts of otherwise valid
DW> address forms.
It seems that it will only tell you if an address is subscribed, not let
you so a full substring search. Then again, I might not have found the
proper button (one reason I dislike graphical interfaces).
This is really as good as you can get with a web interface. You have to
result to confirmation tokens for sensitive things, which would be
impractical in that situation.
DW> [...] and it still doesn't prevent anyone from finding out if any
DW> specific address is subscribed to a given list.
Outside of just not having that functionality in the interface, there will
never be a way to prevent it.
- J<
Follow-Ups:
References:
|
|
