john-users - breaking the same password stored in different format

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall Wordlists CD (20+ languages) with delivery worldwide or download

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Sun, 8 Jan 2006 09:49:57 +1100
From: atstake atstake <atstake@...il.com>
To: john-users@...ts.openwall.com
Subject: breaking the same password stored in different format

I have some users who use the same password for samba, imap (cyrus),
pop3, proxy squid in Linux and also for local windows login. The
passwords have both upper/lower-case characters, numbers and
meta-characters and are >8 characters in length.

Now, if I run john against /etc/shadow & break a password in less than
an hour, can I make a safe assumption that the same password that is
used to authenticate users in POP3, IMAP, Samba, Proxy and Windows can
also be compromised in that exact amount of time? Given that they all
have different mechanims as to how they store passwords this should
not be possible or is it?