[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Jun 2005 05:00:55 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John
I wrote:
> >You need to realize, though, that an attacker with access to the
> >password hashes would be able to crack all the same passwords in the
> >same way, albeit after spending quite some processor time on it too.
On Thu, Jun 23, 2005 at 12:54:59AM +0200, Frank Dittrich wrote:
> If you don't secure the access to the log file (and word list file(s)
> or .chr files) as well, the attacker could even restrict his cracking
> attempts to one (or two) mangling rules per password which has been
> cracked and to the users who's passwords have been cracked.
That's a very good point. It serves to show how little is in fact
achieved by not storing the actual cracked passwords, yet storing other
information (such as how long it has taken to crack a given user's
password).
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
