Re: Anybody using Pantomime or mail-core framework?

FROM : Jens Alfke
DATE : Wed May 14 01:45:30 2008

On 13 May '08, at 4:35 PM, Matt Burnett wrote:

> Its not hard to enable HTTP authentication.


It's also not hard to eavesdrop on the HTTP session using tcpdump, or 
to debug or disassemble the app to recover the password.
In other words, putting a shared secret into an application 
distributed to end-users is not secure.

Probably not a realistic fear in this particular case, but there are 
many, many instances of web scripts like this being abused to send 
spam, so I don't think I'm being overly paranoid :)

—Jens