|
Authored by: Anonymous on Wednesday, July 03 2013 @ 05:59 PM EDT |
ROT13 does not hide the information from public disclosure. They were
populating e-mail addresses to a public URL. If they used ROT13 of the
ICC-ID in the public URL it might be harder to guess valid URLs, but they
would still be public with no access restrictions. If you think about it
ICC-ID is just a stupid way obfuscation the e-mail address that they want to
pre-populate.
What they should have done is just had the client hold the
e-mail address in a cookie and populate the form from the cookie. Shockingly,
this is how EVERY other web site on the internet pre-populates login
forms. In this case, since you have to know the user id in order to see a page
with the user id pre-populated, the only purpose of encryption would be to
prevent packet sniffers from scooping up e-mail addresses in transit. [ Reply to This | Parent | # ]
|
|
Authored by: Anonymous on Friday, July 05 2013 @ 12:21 AM EDT |
I was partly joking, but also partly reiterating the stupidity of the [DMCA] law
that makes it an offence to get round encryption, especially when that
encryption is pathetic and has not been used "seriously"[1] by anyone
for years; ROT13 is something school boys (a) use and (b) break (well I did, and
that was back in the '70s).
ROT26 is a perfectly "good" encryption as far as the DCMA is
concerned.
[1] "Seriously" as in /really/ wanting their data not to be read by
others, as opposed to being used because they can't be bothered to use proper
encryption and rely on stupid laws to push the blame on someone else when it's
more their fault when the data they aren't really that interested in keeping
safe is exposed. Anyone using a simple encryption ought to be named by any
defendant as aiding and abetting them and brought in as a co-defendant - after
all they deliberately chose a simple encryption to help them break it (didn't
they?).[ Reply to This | Parent | # ]
|
|
|
|
|