RE: iSeries passwords

["Ingvaldson, Scott" <SIngvaldson@xxxxxxxxxxxx>]

I'm serious here, this thread began with a discussion of the implications of
using password validation programs and the dangers of (user) passwords
transmitted in clear text.

This applet's instructions state:

   1. Select Run Checkup Report.
   2. Accept the NetIQ Corporation digital certificate.
   3. Sign on to the iSeries server that you would like to run the iSeries
10 Point Checkup on by entering a system name, User id and password with
*SECADM special authority on the iSeries server. 

When you click Run Checkup Report it presents you with a (non-secure)
webpage that tells you it's running, requires you to accept a valid
appearing certificate, then presents you with a box requesting your system
name and a user id and password with *SECADM authority.

How do you know that this applet does not send your SECADM profile and
password back to the originator?  How do you know what it installs?

How do you know that this was not created by some "social engineer" who
wants to make a name for themselves by creating the first iSeries virus?

These are just questions, good security means a lot more than nobody knows
your password.

Regards,

Scott Ingvaldson
AS/400 System Administrator
GuideOne Insurance Group


-----Original Message-----
date: Wed, 19 Nov 2003 12:54:51 -0500
from: rob@xxxxxxxxx
subject: RE: iSeries passwords

Lots of people will, and have.

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 

--
"Ingvaldson, Scott" <SIngvaldson@xxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
Subject
RE: iSeries passwords

I'm sure that this is a slick little utility, but I'm curious.  How many 
of us would let a java applet from a website access our systems with *SECADM
authority, even one from a reputable company?

Regards,

Scott Ingvaldson
AS/400 System Administrator
GuideOne Insurance Group

-----Original Message-----
date: Wed, 19 Nov 2003 08:59:33 -0500
from: rob@xxxxxxxxx
subject: RE: iSeries passwords

Everybody and their brother has a utility that will tell you which 
passwords on your iSeries were too easy to crack.  Like the following:
http://www.netiq.com/products/vsa/10point.asp

Rob Berendt
   
This message and accompanying documents are covered by the Electronic
Communications Privacy Act, 18 U.S.C. §§ 2510-2521, and contains information
intended for the specified individual(s) only. This information is
confidential. If you are not the intended recipient or an agent responsible
for delivering it to the intended recipient, you are hereby notified that
you have received this document in error and that any review, dissemination,
copying, or the taking of any action based on the contents of this
information is strictly prohibited. If you have received this communication
in error, please notify us immediately by e-mail, and delete the original
message.