[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Dec 2018 09:37:28 +0000
From: "Knight, Tom" <tom.knight@....ac.uk>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Just tell me the password's crackable, not what it is?
Hi all.
I've looked through the FAQ, wiki and had a small search of this list and not seen the answer, so I need to ask. Please be patient if this sounds obvious or daft.
I'd like to audit the passwords held on my system, but I don't want to know what the passwords are.
Someone suggested JtR had an option to show how long it took to crack each password but without having the ability to store the plaintext. Just say "Yes, I did it, it was easy" or similar. With this information I could inform users there's a problem, and (basically) cover my back. There's lots of trust here (like I can do all the things you'd expect a sysadmin to be capable of), but as soon as I actually know a password I start feeling uncomfortable, and given people *still* reuse them I'd expect them to too...
Feel free to point me to the fine manual if I've missed that bit!
Oh, using 1.8.0-jumbo-1 on Linux.
Many thanks,
Tom.
--
Tom Knight
System Administrator
Department of Geography
University College London
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
