Re: [Full-Disclosure] yahoo mail image verification

[Thierry Haven <thierry.haven@xxxxxxxxxxxxxxxx>]

After testing the French Yahoo portal, it appears that this flaw 
actually exists. Let's hope they'll fix it soon. However, the impact of 
a bruteforce attempt is minimal if you have a strong password by default 
...

I've submitted this bug to Yahoo for review.

_______________________________________
Thierry Haven - Xmco Partners
Security Consulting / Pentest
web  : http://www.xmcopartners.com


cumhur onat wrote:

> Did you realized that the image verification in yahoo mail which
> appears after some insuccesfull attempts is not working properly,
> becus i can just leave it blank and continue trying, dont tell me that
> it wont work if I enter a true passwrd without the verification code .
> It works i  have tried with 6 accounts and managed to enter the inbox
> after about 40 tries.
> Sorry for my bad english :(
> Hope you understand what I mean...
> Cumhur Onat
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>  

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html