Date: Thu, 24 May 2012 23:05:42 +0200 From: Frank Dittrich <frank_dittrich@...mail.com> To: john-users@...ts.openwall.com Subject: Re: Can Excessive Rounds make Password cracking Infeasable On 05/24/2012 10:49 PM, magnum wrote: > As others pointed out there are reasons the default rounds figure is not > higher. I can imagine if just *some* or even only one hash had a much > higher round, I would get more interested in those. OTOH this could be > used to fool attackers (using a couple of impossible passwords with a > very high rounds figure) to waste resources on dummy accounts. Even without changing the iteration count, this might be an idea: Against attackers who might get hold of the hashes, but can't tell real users from fake users, you can just create a large number of dummy accounts with very hard to crack passwords. Then, the attackers will have a much higher number of different salts, slowing down the speed of their cracking attempts, without increasing login time for real users. Of course, this doesn't help against malicious insiders. Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.