[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <OF87EA4F7C.FB56ED0B-ONCA257C85.007EB241-CA257C85.0080A1EF@au1.ibm.com>
Date: Fri, 21 Feb 2014 10:25:00 +1100
From: Mark Butler <markb@....ibm.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John
> Date: Tue, 21 Jun 2005 16:28:29 -0400
> From: Jim Brown <jpb@...shooter.v6.thrupoint.net>
>
> I've used john in an enterprise environment as a strong
> password compliance tool and I've had these concerns:
>
> 1. The passwords are visibly displayed.
> 2. The .pot file contains password data that can be displayed
> by running john at a later time.
I would like to revisit the above. Ideally I would like a setting in
john.conf to be able to turn on Secure Mode for john. I would envisage that
when it is set, instead of john passing back the clear text password, it
would pass back attributes of the password instead. Things like length,
mode john is running in (Single crack [S], Wordlist [W], Incremental [I],
External [E]) and the rule matched in that mode. eg: L8-W-R13 for a
password 8 characters in length, cracked in Wordlist mode using rule 13.
Hopefully all this information is available to john at the time the
password is cracked.
The flow on effect would be the .pot file would include the encrypted
password with password attributes instead of the clear text password.
I am just running john to determine if a weak password has been used so
only run john in Single crack and Wordlist without rules modes. So am not
particularly interested in the actual password used.
The advantages for me would be since no actual passwords are being stored
or transmitted by john in this Secure Mode, then it would open the
possibility to be able to run it in less secure environments, eg home.
Regards
Mark B
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
