Re: [Full-Disclosure] Google Desktop Search

[rem]

What is the added benefit of sending MD5 hashes instead of plain-text 
passwords? I mean, the MD5 hash will be the same for the same password, 
isn't it?

I hope that Yahoo has implemented something more complicated that that, 
otherwise it is plain pointless.

-- rem.
[EMAIL PROTECTED] wrote:
 Read the javascript in the headers of Yahoo's login page:
<-- Begin javascript comments from Yahoo -->
/*
 * A JavaScript implementation of the RSA Data Security, Inc. MD5 Message
 * Digest Algorithm, as defined in RFC 1321.
 * Copyright (C) Paul Johnston 1999 - 2000.
 * Updated by Greg Holt 2000 - 2001.
 * See http://pajhome.org.uk/site/legal.html for details.
 */
<-- End Javascript comments from Yahoo -->
THEY don't even cache, or pass, your password. Like all secure programs,
they store, and transmit, an MD5 Sum. 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html