Subject: [Ipsec] regarding the mailing list memberships reminder

From: "Jimmy Zhang" <[email-masked]>
Date: Thu, 1 Feb 2007 10:55:51 -0500

Hi,
 
I just received another monthly membership reminder email. To my
surprise, at the end of the email, it lists my email address and my
password. If this is one of the many yahoo groups, I don't care, but
this is supposed to be the top professional IP security mailing list of
the world, we try our best, some of them even spend their whole life, to
make the Internet more secure. Here, we send all their passwords in
plain text to the Internet, and we do it once a month...
 
Thanks,
Jimmy
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Gadi Evron <[email-masked]>
Date: Thu, 1 Feb 2007 10:05:37 -0600 (CST)

> plain text to the Internet, and we do it once a month...

That's how mailman works.

I agree it is far from best practice and these reminders can probably be
turned off anyway. Regardless of if it is a large issue or not, it simply
shouldn't happen.

With that in mind, is it that big of a deal with what this password lets
you do on an open list?

	Gadi.

---

From: "Jimmy Zhang" <[email-masked]>
Date: Thu, 1 Feb 2007 11:51:00 -0500

When you say that, I guess you wrongly assume "Perfect Forward Secrecy" of people's passwords. Unfortunately, they are not.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 1 Feb 2007 18:15:35 +0000

On Thu, 1 Feb 2007 11:51:00 -0500
"Jimmy Zhang" <[email-masked]> wrote:

> When you say that, I guess you wrongly assume "Perfect Forward
> Secrecy" of people's passwords. Unfortunately, they are not.
> 

If you're using this password for anything other than this mailing
list, that's the real problem....

That said, you can turn off the password reminder for yourself.  Click
on the link, use that password, and click on subscription options.
You can also change your password there... 

I should that while in general, one shouldn't send sensitive
information in the clear, it's far from clear to me that this password
is sensitive.  

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

---

From: "Jimmy Zhang" <[email-masked]>
Date: Thu, 1 Feb 2007 13:53:12 -0500

"The RSA survey found that maintaining online identities is becoming a burden for many people who, on average, use 20 sites that require them to register and then log on afterwards. To make these different online personas easy to manage, two-thirds use the same password for all the different sites

http://news.bbc.co.uk/1/hi/technology/3639679.stm
"
 
ANY password is sensative, no matter you think so or not. 

________________________________

From: Steven M. Bellovin [mailto:[email-masked]]
Sent: Thu 2/1/2007 10:15 AM
To: Jimmy Zhang
Cc: Gadi Evron; [email-masked]
Subject: Re: [Ipsec] regarding the mailing list memberships reminder

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 1 Feb 2007 22:09:01 +0000

On Thu, 1 Feb 2007 13:53:12 -0500
"Jimmy Zhang" <[email-masked]> wrote:

> "The RSA survey found that maintaining online identities is becoming
> a burden for many people who, on average, use 20 sites that require
> them to register and then log on afterwards. To make these different
> online personas easy to manage, two-thirds use the same password for
> all the different sites
> 

Believe me, I know that phenomenon.  That's why I don't know my IETF
password.  I don't need it most of the time; when I do, I just invoke
the password recovery mechanism.  Nor did I pick it; I let mailman
generate a random one for me.

People use the same password for sites where they need the password to
log in with any frequency.  99.99% of mailing list users never use it
except to unsubscribe, and even that doesn't need the password.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 2 Feb 2007 16:53:38 -0500

On Thu, 1 Feb 2007 22:09:01 +0000

> except to unsubscribe, and even that doesn't need the password.
Thinking further, I overstated the case for some scenarios.  For closed
mailing lists, the password is frequently necessary to gain access to
the archives.  That content is quite likely sensitive.  For those
mailing lists, monthly password reminders should probably be turned off
-- but that leaves unsolved the password recovery problem for users who
rarely visit the archives and hence are likely to forget their
passwords (or reuse sensitive ones).