Netscape && FTP sites

• To: www-security@ns2.rutgers.edu
• Subject: Netscape && FTP sites
• From: "Seth I. Rich" <seth@hygnet.com>
• Date: Tue, 12 Mar 1996 13:00:45 -0500

I was recently looking for documentation on the Netscape site and I found
something which disturbed me a bit.  (The Netscape site isn't lynx-friendly,
so I can't search it now for a citation.)

Is it true that, when connecting to an anonymous FTP site, Netscape sends
username anonymous and password "mozilla@<site>"?  It was my understanding
(in fact, the FTP sites I maintain say this explicitly) that the password
specified is to be the email address of the person requesting (or submitting)
the data.  What I recall reading is that Netscape -always- sends this bogus
address even if the user has entered her real address into the browser's
configuration.

Is this true?  Does this seem like a problem to anyone else?  Is it patchable?

Seth
---------------------------------------------------------------------------
Seth I. Rich - seth@hygnet.com - (610) 859-0100
Systems Administrator / Webmaster, HYGNet       My words are my own; please
Rabbits on walls, no problem.                   don't blame my employer!

• Re: Netscape && FTP sites
• From: Rob Jenson <jenson@nasirc.hq.nasa.gov>
• Re: Netscape && FTP sites
• From: Gene Ingram <gene@hpfsvr01.cup.hp.com>
• Re: Netscape && FTP sites
• From: Adam Shostack <adam@bwh.harvard.edu>

• Previous: CGI Scripts and Permissions
• Next: Re: Java "security holes'
• Index(es):
  • Index
  • Thread