Date: Wed, 10 Aug 2011 11:38:17 +0200 From: magnum <rawsmooth@...dband.net> To: john-dev@...ts.openwall.com Subject: Re: "valid character" class On 2011-08-10 05:27, Solar Designer wrote: > My concern, though, is that I am unsure what use cases we will have for > either of these new classes. Do you have specific rules you'd like to > add, but can't do it yet? Are you aware of specific real-world > passwords that this would crack? So far, all this encodings stuff feels > a bit theoretical. I guess it will be relevant in the future, but is it > already relevant? Perhaps it is, but we're yet to see it actually being > used to crack passwords... I'm not sure about the new classes, time will tell. If they prove worthless we can ditch them. The rationale was that adding them was dead easy (the only metadata we haven't yet found a way to get "for free" for any codepage is the distinction of vowels and consonants) and there's no point in including impossible combinations when attacking slow hashes in this or that codepage. About encoding in general: I know it is already relevant, though naturally much less so for Americans like Korelogic than for their colleauges in Greece, France or Slovenia. I only have one single concern and that is performance - especially if hitting performance when *not* using the new options. We try to design so it won't happen, and if it does anyway and we fail to mitigate it we will reconsider or redesign. magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.