In addition to notifying Netscape, RST suggested a simple fix to the flaw. Software is becoming ubiquitous and increasingly complex. Businesses think they can solve all of their security problems with firewalls and network perimeter security, but we have found that the biggest risks in today's distributed systems exist in custom software applications. This is another illustration of how bad closed, proprietary, cryptography is. If you can attack someone's mail server password, you're likely to also have their login password, PGP password, etc.
Software security is important.
Tim Hollebeek and John Viega, members of RST's Software Security Group and Research Labs, did not reverse engineer Netscape's code or use automation to discover the flawed algorithm. The exact decryption algorithm used by Netscape and its location in the code is not known. However, experimentation verifies that the algorithm created at RST gives equivalent output in all cases for passwords up to 33 characters in length. Founded in 1992 on the simple, compelling premise that software must work, the company offers methodologies and services that help organizations deliver reliable, secure, and safe software - the essence of software assurance. Netscape Navigator is a trademark or registered trademark of Netscape.