[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20060527080850.GA17289@openwall.com>
Date: Sat, 27 May 2006 12:08:50 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: how decrypt that ?
When I set up this mailing list a year ago, I was afraid that we would
have flame wars in here - specifically because of the "dual-use" nature
of John the Ripper. Surprisingly, it is the first time we're having
this debate in here - and it is very far from a flame war. :-)
On Fri, May 26, 2006 at 11:16:41PM -0500, Randy B wrote:
> I pondered expressing my opinion of such a request, but decided it
> better to withhold moderation until I found out what the list's
> typical response is to these kind of requests - I've jumped up and
> down on a few things before without realizing that my sentiment was
> not shared within the given forum.
You can feel free to express your opinion as long as it is on topic,
likely of interest to other john-users, not offensive, etc. It does not
have to match "the typical response".
> One has to wonder what precisely you just cracked the password to,
Some web forum member profile or the like, I presume. But that's just a
guess. It is also not known to us whether "websiteaccess" (what a name)
was authorized to crack that password hash or not. I could have raised
that question first, but I primarily care about the usefulness of
john-users postings to other subscribers and to those browsing the
archives - and I think that the posting that I did make was of more use.
> and why.
I can answer that.
websiteaccess's question was already on the list. It was a trivial
question, yet on topic, reasonable, and likely of interest to more than
just websiteaccess. If the question were left without a response, it
would have been just noise to all of us currently on the list and to
those browsing the archives. Now that there is an accurate response
with an example of just how this real-world password was found to be
very weak when hashed with raw MD5, both postings are useful information
in the list archives (which become kind of a John the Ripper and
password (in)security knowledge base).
As it relates to my posting the actual plaintext password, I did
hesitate for a moment. However, from past discussions in here, I knew
that websiteaccess is smart enough to follow the instructions - and it
would be unreasonable and counter-productive to give cryptic
instructions since they're meant to benefit john-users at large. So
posting the actual password did not make the resource it was meant to
protect any more vulnerable, but it did help illustrate just how very
weak that particular password and raw MD5 are.
FWIW, you can find websiteaccess's past postings here:
http://search.gmane.org/?query=websiteaccess&group=gmane.comp.security.openwall.john.user
I think that responses to some of these were of use to other john-users.
> I guess we who use such an easily misapplied tool for
> professional reasons must put up with those who... don't...
Yes, that's pretty much the case.
> Solar - you're quite the open, helpful chap. ;-)
I can share your sarcasm. My current stance on this issue, as described
above, is not obviously right - but I don't think that anyone else's is.
I am not always so helpful. If this question were sent to me privately,
I would most likely not bother responding at all.
Similarly, if a question asked on john-users is off-topic and the answer
would be off-topic as well, I don't respond - and usually also
unsubscribe whoever has asked the question (these people are typically
in here by mistake, so I am doing them a favor). So far, I did this
primarily for questions such as "how crack notmyemail@...mail.com???"
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
