[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 15 Apr 2012 22:32:59 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: identifying patterns to successfully crack more passwords (was: automation
equipped working place of hash cracker, proposal)
On 04/13/2012 04:39 PM, Aleksey Cherepanov wrote:
> Also some patterns (like month appended to password when
> policy is to change password every month) could be found during cracking.
Yes, such knowledge about password change policy can be very helpful.
If you know that people (have to) change their passwords monthly, it is
a valid assumption that a lot of passwords will somehow be based on
month names or numbers.
(Appending such numbers is not always caused by people changing their
passwords once per month. It could also be caused by people working
around a certain password history size which requires them not to reuse
one of the previously used 5, 10, ... passwords, or just because numbers
are required due to password policy.
Whatever the reason, just switching numbers while keeping the main part
of the password unchanged seems to be common practice.)
> During contest search of patterns was very valuable.
Yes. Did you think about ways to make that easier, e.g., detect patterns
automatically, and decide in which sequence to try those patterns
on the remaining password hashes?
What if you detect patterns in cracked passwords submitted by other
users, and after trying to find more passwords with the same patterns
you realize there are no more such passwords because the user already
tried all password candidates for these patterns?
You'll have wasted time due to duplicated effort.
Can you think of ways how to prevent this (more or less automatically
instead of manually)?
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
