Re: Passwords in the clear update

From: "John Kemp" <john.kemp@nokia.com>
> What are these legitimate reasons? Or perhaps put another way, what do
> we consider a "password" to be, if not a *secret* best shared only
> between exactly two parties and used to authenticate one party to the
> other?

Well none of the definitions of password that I come across mentions
"exactly two parties".   Which just goes to show that "Password" means
different things to different people.  I think that's the primary cause of
this debate.

I recommend including a definition, right up front in the finding: "For
purposes of this finding a password is defined as ....."  ....  and craft a
definition that fits the finding.

--Ray

Received on Friday, 10 October 2008 17:34:01 UTC