Subject: A diff for the latest version?

From: "J. Joseph Max Katz" <[email-masked]>
Date: Wed, 14 Oct 1998 22:27:16 -0700 (PDT)

Hi!

I made some quick additions to what was just posted. I find that users
react better when we give them more realistic scenarios instead of 
saying "don't do this, it's bad."

I changed around some of the wording in a few parts-- "trusted" network
instead of "'secure' net" when talking about modems. I also talked about
how "crackers" dial sequentially phone numbers.

Also, I don't know if it is too late now, but we should add a section
about IRC and "other services"-- most of which aren't secure. It could
talk about everything from evasdropping on IRC sessions to how ICQ and
other clients are vulnerable to attacks from malicious users.

   Jonathan Katz, CEO CPIO Networks, Inc.
     (408) 569-7092 [ ] [email-masked]
       http://www.cpio.net [ ] "offering OpenBSD
         technical support, on-site Unix and
           network security services and training."
--- draft-ietf-ssh-users-09.txt.old	Wed Oct 14 22:12:17 1998
+++ draft-ietf-ssh-users-09.txt	Wed Oct 14 22:21:27 1998
@@ -277,10 +277,10 @@
    has the capability of using the network, with or without informing
    you.  Say, for example:
 
-      You download a game program from an anonymous FTP server. This
-      appears to be a shoot-em-up game, but unbeknownst to you, it
-      transfers all your files, one by one, over the Internet to a
-      cracker's machine!
+      You download a game program from an anonymous FTP server or 
+      website. This appears to be a shoot-em-up game, but unbeknownst to 
+      you, it transfers all your Email and personal contact database to 
+      a cracker's machine!
 
    Many corporate environments explicitly prohibit the downloading and
    running of software from the Internet.
@@ -489,9 +489,9 @@
    public networks.  If your computer is attached to such a network, you
    must exercise care when also using a modem.  It is quite possible to
    use the modem to connect to a remote network while *still* being
-   connected to the 'secure' net.  Your computer can now act as a hole
-   in your network's defenses.  Unauthorized users may be able to get
-   onto your organization's network through your computer!
+   connected to the 'trusted' network.  Your computer can now act as a 
+   hole in your network's defenses.  Unauthorized users may be able to 
+   get onto your organization's network through your computer!
 
    Be sure you know what you are doing if you leave a modem on and set
    up your computer to allow remote computers to dial in.  Be sure you
@@ -503,8 +503,9 @@
    computer to be accessed by phone.
 
    Note that having an unlisted number will not protect you from someone
-   breaking into your computer via a phone line.  It is very easy to
-   probe many phone lines to detect modems and then launch attacks.
+   breaking into your computer via a phone line.  Crackers have software
+   which sequentially goes through all the phone lines in an exchange in
+   order to find systems where they can launch attacks.
 
 3.7 Don't Leave Me...