Subject: CAP: error code 6.9 leaks data

From: John Stracke <[email-masked]>
Date: Thu, 16 Aug 2001 14:33:18 -0400

CAP section 7.1.3 defines an error code, 6.9, which reports that the 
user exists, but cannot use the given mechanism. I believe it's 
generally considered a bad idea to tell an unauthenticated client a user 
exists, because it aids with dictionary attacks. (For example, when you 
log in to a Unix system, it doesn't distinguish between a bad username 
and a bad password; either way, it just says "Login incorrect".)

-- 
/==============================================================\
|John Stracke    | http://www.ecal.com |My opinions are my own.|
|Chief Scientist |=============================================|
|eCal Corp.      |Organ transplants are best left to the       |
[email-masked] <mailto:[email-masked]>|professionals.                               |
\==============================================================/

---

From: George Babics <[email-masked]>
Date: Sun, 19 Aug 2001 14:13:15 -0400

I Agree. It should return code 6.0.

George