[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20100316152448.GA26641@openwall.com>
Date: Tue, 16 Mar 2010 18:24:48 +0300
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] passwdqc 1.2.0, screenshots, policy considerations, passwdqc-users mailing list
Hi,
passwdqc, our proactive password/passphrase strength checking and policy
enforcement toolset, has been enhanced in many ways, bringing it up to
version 1.2.0:
http://www.openwall.com/passwdqc/
The pwqcheck program is now directly usable as the passwordcheck program
on OpenBSD - that is, to check users' passwords as they're set with the
"passwd" program, much like it is done on systems with PAM. The man page
for pwqcheck and the PLATFORMS file have been updated to provide brief
instructions on setting this up:
http://www.openwall.com/passwdqc/PLATFORMS.shtml
pwqcheck is now also able to check multiple passwords/passphrases at
once - e.g., for policy testing on large password/passphrase lists.
Simply running "pwqcheck -1 --multi" reads passwords/passphrases to
check from standard input (until EOF) and prints the check status for
each. This functionality was in fact used on large publicly-available
lists of cracked passwords to see/verify the effect of other changes
made in this version of passwdqc (described below).
The random passphrases offered by pam_passwdqc, pwqgen, as well as by
the passwdqc_random() function in libpasswdqc, will now encode more
entropy per separator character and per word, increasing their default
size from 42 to 47 bits. The size of 42 bits was adequate to withstand
not-too-powerful attacks against bcrypt hashes that we use on Owl, but
it was inadequate with weaker hashes that many other systems use. (In
fact, for the weakest hash types, such as those used by some "web apps",
47 bits is inadequate too, but we can't reasonably increase the default
much further. Instead, those systems/programs should be fixed to use
hashes that implement "password stretching".)
Substring matching will now partially discount rather than fully remove
weak substrings, support leetspeak, and detect some common sequences of
characters (sequential digits, letters in alphabetical order, adjacent
keys on a keyboard). The combined effect of these changes is that it
should become slightly easier to come up with a password that would pass
the requirements (there will be fewer spurious "based on a dictionary
word" rejections), yet the percentage of likely-crackable passwords
passing the checks should decrease.
The passphrase strength checking code will now detect and allow
passphrases with non-ASCII (8-bit) characters in the words. This should
make it easier to use non-English passphrases.
A number of optimizations have been implemented resulting in significant
speedup of passwdqc_check() on real-world passwords. This matters for
"pwqcheck --multi".
RPM packages can now be built out of the distribution tarballs. This is
briefly described in the INSTALL file:
http://www.openwall.com/passwdqc/INSTALL.shtml
We've setup a web page with screenshots demonstrating the uses and setup
of passwdqc:
http://www.openwall.com/passwdqc/screenshots
and a wiki page with password strength policy considerations aimed at
systems administrators deploying and configuring passwdqc:
http://openwall.info/wiki/passwdqc/policy
We have also setup the passwdqc-users mailing list. Please use it to
share your experience with passwdqc and ask questions. The subscription
instructions are found right on the passwdqc homepage:
http://www.openwall.com/passwdqc/
Alexander
P.S. Social bookmarking buttons have been added to most pages on the
Openwall website, as well as on the Wiki. Please use these to add your
favorite Openwall web pages to your favorite social websites.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
