Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Jun 2005 05:00:55 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John

I wrote:
> >You need to realize, though, that an attacker with access to the
> >password hashes would be able to crack all the same passwords in the
> >same way, albeit after spending quite some processor time on it too.

On Thu, Jun 23, 2005 at 12:54:59AM +0200, Frank Dittrich wrote:
> If you don't secure the access to the log file (and word list file(s)
> or .chr files) as well, the attacker could even restrict his cracking
> attempts to one (or two) mangling rules per password which has been
> cracked and to the users who's passwords have been cracked.

That's a very good point.  It serves to show how little is in fact
achieved by not storing the actual cracked passwords, yet storing other
information (such as how long it has taken to crack a given user's
password).

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ