> It's probably too late, but rather then removing user:password support
> altogether, maybe Microsoft could replace it with a dialog that informs the
> user they are about to visit "session-arhuz.ru" with the username
> "www.herbank.com", and an appropriate warning about not revealing sensitive
> information, blahblahblah?

As an answer to the question "Are you sure that you want to... bla,bla ...as
this may reveal sensitive information?", 99% of the users will click "Yes" as
they always do.

Even if the question is phrased "...do you wish to abort this action?", most
users will simply try a few times by clicking "yes" and finally actually read
the question and the warning before clicking "no".

The problem is that most people do not cultivate the high-grade paranoia that
most readers of Bugtraq do, and that is what makes security so difficult to
implement, especially if security is to be retrofitted to a protocol or
product. People make the choices that is most convenient to their daily use;
allow everything, don't upgrade, don't patch.

In fact, most people don't even know why they should patch. I've even heard
the urban legend that running Microsoft Update is dangerous as your computer
may get infected by computer viruses that way.

--
Gunnar Ostlund Tel: +46 920 492039
Computer Support Centre Email: Gunnar.Ostlund (at) dc.luth (dot) se [email concealed]
Lulea University of Technology
S-971 87 Lulea
Sweden

[ reply ]