On Wed, 7 Feb 2018, Dan Fandrich wrote:

> If the application/script sets --netrc then an attacker would just need to
> supply a username and curl would fill in the password, allowing attacks on
> machines that honoured those credentials (probably only local machines). And
> if --negotiate or --ntlm are enabled, then the attacker may not even need to
> supply a username to attack a local machine, as the request could be
> automatically authenticated as the local user.

Oh yes, excellent thinking. Thanks, I consider that a pretty strong argument
for adding an option that switches off this ability.

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette:   https://curl.haxx.se/mail/etiquette.html