 |
 |
On Nov 28, 2007, at 10:11 AM, Richard T Houang wrote: > MSU, as owner of MSUnetIDs, should investigate as they are asking > for MSUnetIDs and passwords. It will be very easy for the site to > keep the information. This has been a longstanding issue. So long as we don't filter traffic to/from the KDC/IMAP/POP or any other standard service we provide which authenticates users, leakage is impossible to control. AllMSU.com has been providing services like this for years, which encourage students to provide their MSUNetID and password. I have always discouraged using these types of services for the obvious security reasons, but from a technical perspective, this credential leakage is unmanageable. ./mk -- Matt Kolb <[log in to unmask]> Academic Computing & Network Services Michigan State University