Re: AS400 user password (fwd)

["V. LeVeque" <vleveque@xxxxxxxxxxxxx>]

This is exactly the point of all those "petty" requirements of a C2
certification - to ensure that object reuse does not result in sensitive
information being leaked.  You know, why you shouldn't be able to view other
user's QTEMP and things of that sort.

I hate to say "I told you so", but a lot of this difficult and seemingly
impractical security theory really DOES matter for us "just plain business
systems folk"

Be grateful this is an AS/400 and not Windows NT, or this code would be
posted throughout the Internet as we speak.  The only thing saving us with
this is the relative lack of interest in the AS/400 by the hacking community.


At 07:59 PM 6/9/00 -0500, you wrote:
>From: William Washington III <w.washington@iols.net>
>> I'm sure the infamous 17-line RPG IV program is a call to one
>> of the service routines.  (But I haven't seen it... I could be wrong!)
>
>
>You are in fact wrong. It is much simpler than that. The signon
>program reads a screen buffer with your user ID and password
>you just typed. The contents of that buffer hangs around until
>signoff or another signon (when it will contain yet another
>password !). A general principle of secure working is the
>erase the contents of all buffers and variables as soon as
>they are no longer needed. IBM violated that simple principle.
>
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---