Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3315

Re: Is computer security culture simply broken?

Show all headers | View raw

On 28/05/2014 8:02 PM, Rich wrote:
> Sylvia Else <sylvia@not.at.this.address> wrote:
>> On 26/05/2014 12:18 AM, Rich wrote:
>
>>> Time pressure may be a big influence.  It is also easy to do a plain
>>> text password:
>>>
>>>     select 1 from users where id = 'joe' and password = 'frank';
>>>
>>> Granted, one should use parameters rather than sql injection ready
>>> code, but the above is easy to code, esp. while the system is still
>>> running on the developers workstation only.  And it works, or at least
>>> appears to work, from the point of view of the testing folks.  So no
>>> one notices.
>
>> Perhaps we should just remove literals from SQL altogether. Yes, there
>> are many places where a literal makes sense, but since programmers
>> cannot be trusted to use them safely, let's rip them out. Programmers
>> will have to learn how to use parameters. Some would probably be
>> surprised to learn that parameters even exist.
>
> We'd save ourselves the sql-injection possibilities that way.  We'd
> lose the ability to hand type an SQL query at a prompt.

No, it would just mean that the query had to be parsed and the literals 
extracted and passed in as parameters.

>
> But that change would do nothing to prevent bad password storage
> implementations.

True enough, but one step at a time.

Actually, I wonder why we're even still using passwords.

Sylvia.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web