[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BAY107-F19207BFF15B8E2809B83CEFDEB0@phx.gbl>
Date: Thu, 23 Jun 2005 00:54:59 +0200
From: "Frank Dittrich" <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John
>You need to realize, though, that an attacker with access to the
>password hashes would be able to crack all the same passwords in the
>same way, albeit after spending quite some processor time on it too.
If you don't secure the access to the log file (and word list file(s)
or .chr files) as well, the attacker could even restrict his cracking
attempts to one (or two) mangling rules per password which has been
cracked and to the users who's passwords have been cracked.
>Yes, I had a couple of requests for this before (that's like - just 3
>requests, including yours, in 9 years).
With the existence of this mailing list, others will at least have
a chance to know which topics have already been discussed.
Hopefully, this reduces the trouble you have to repeatedly answer
the same questions ;)
>Yes, this is a reasonable thing to implement. One difficulty with
>implementing it is that it would still be desirable to have password
>hashes recorded in john.pot (such that interrupted sessions could be
>recovered, fully-cracked split password hashes could be distinguished
>from partially-cracked ones, and a list of users with fully-cracked
>passwords could be output). This would require a john.pot file format
>change to encode no-plaintext differently from empty-plaintext.
Securing john.pot appropriately against unauthorized access would still
provide better security.
If nothing else helps, run john on a separate machine.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
