[Savannah-hackers] Re: savannah account

[Thomas Bushnell, BSG]

Mathieu Roy <address@hidden> writes:

> I do not get the point. Not so strange, I'm not author of the
> registration procedure.
> I you've found a security hole, please submit a bug report with
> details or, why not, send us a patch.

Anyone who can sniff the outgoing traffic from savannah can steal the
password of anyone they like by listening for the email message with
the magic hash key and following the link.

Anyone who can figure out the hash function can steal the password of
anyone they like even if they can't sniff on the email message.  Since
any user can generate hash samples at will, it's surely not too hard
to do this.

Thomas