[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP1654028A18F9947463F463AFD000@phx.gbl>
Date: Thu, 24 May 2012 23:05:42 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Can Excessive Rounds make Password cracking Infeasable
On 05/24/2012 10:49 PM, magnum wrote:
> As others pointed out there are reasons the default rounds figure is not
> higher. I can imagine if just *some* or even only one hash had a much
> higher round, I would get more interested in those. OTOH this could be
> used to fool attackers (using a couple of impossible passwords with a
> very high rounds figure) to waste resources on dummy accounts.
Even without changing the iteration count, this might be an idea:
Against attackers who might get hold of the hashes, but can't tell real
users from fake users, you can just create a large number of dummy
accounts with very hard to crack passwords.
Then, the attackers will have a much higher number of different salts,
slowing down the speed of their cracking attempts, without increasing
login time for real users.
Of course, this doesn't help against malicious insiders.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
