<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">There is nothing difficult about the right course of action here: Don't send the password. Disable this silly default.<div><br></div><div>The attitude expressed in these replies is a disgrace to the profession of software security, and a disgrace to the list.</div><div><br></div><div>It doesn't matter whether or not I "should" be using a unique password. I <b>might not be, </b>and even if I am, a nerd next to me shouldn't be able to change my subscription settings because of the listserv's idiotic setting.</div><div><br></div><div>It is NOT the user's responsibility to compensate for the incompetence of sys admins or software developers. They are the ones who are failing their jobs.</div><div><br></div><div>- Greg<br><div>
<br>--<br>Please do not email me anything that you are not comfortable also sharing with the NSA.<br>
</div>
<br><div><div>On Oct 1, 2013, at 12:03 PM, Lodewijk andré de la porte <<a href="mailto:l@odewijk.nl">l@odewijk.nl</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">It's reasonable as it's not a security sensitive environment. Please for the love of god let some environments stay low-sec.</div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/10/1 Nick <span dir="ltr"><<a href="mailto:cryptography-list@njw.me.uk" target="_blank">cryptography-list@njw.me.uk</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On Tue, Oct 01, 2013 at 10:28:48AM -0400, Greg wrote:<br>
> So, my password, iPoopInYourHat, is being sent to me in the clear by your servers.<br>
<br>
</div>All mailman lists do this by default. It does tell you on the sign<br>
up page that it will do so, and that you shouldn't use a 'valuable'<br>
(e.g. used elsewhere) password - see<br>
<a href="http://www.metzdowd.com/mailman/listinfo/cryptography" target="_blank">http://www.metzdowd.com/mailman/listinfo/cryptography</a><br>
<br>
It is an annoying default, but so long as you don't use a password<br>
attached to anything else you care about, I don't think it should be<br>
too much of a worry.<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
The cryptography mailing list<br>
<a href="mailto:cryptography@metzdowd.com">cryptography@metzdowd.com</a><br>
<a href="http://www.metzdowd.com/mailman/listinfo/cryptography" target="_blank">http://www.metzdowd.com/mailman/listinfo/cryptography</a><br>
</div></div></blockquote></div><br></div>
_______________________________________________<br>The cryptography mailing list<br><a href="mailto:cryptography@metzdowd.com">cryptography@metzdowd.com</a><br>http://www.metzdowd.com/mailman/listinfo/cryptography</blockquote></div><br></div></body></html>