[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4E425189.2040503@bredband.net>
Date: Wed, 10 Aug 2011 11:38:17 +0200
From: magnum <rawsmooth@...dband.net>
To: john-dev@...ts.openwall.com
Subject: Re: "valid character" class
On 2011-08-10 05:27, Solar Designer wrote:
> My concern, though, is that I am unsure what use cases we will have for
> either of these new classes. Do you have specific rules you'd like to
> add, but can't do it yet? Are you aware of specific real-world
> passwords that this would crack? So far, all this encodings stuff feels
> a bit theoretical. I guess it will be relevant in the future, but is it
> already relevant? Perhaps it is, but we're yet to see it actually being
> used to crack passwords...
I'm not sure about the new classes, time will tell. If they prove
worthless we can ditch them. The rationale was that adding them was dead
easy (the only metadata we haven't yet found a way to get "for free" for
any codepage is the distinction of vowels and consonants) and there's no
point in including impossible combinations when attacking slow hashes in
this or that codepage.
About encoding in general: I know it is already relevant, though
naturally much less so for Americans like Korelogic than for their
colleauges in Greece, France or Slovenia. I only have one single concern
and that is performance - especially if hitting performance when *not*
using the new options. We try to design so it won't happen, and if it
does anyway and we fail to mitigate it we will reconsider or redesign.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
