Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

RE: Senior M$ member says stop using passwords completely!
From: "Mark Challender" <MarkC () mtbaker wednet edu>
Date: Fri, 22 Oct 2004 10:33:22 -0700

A simple passphrase -- Golfmakesyougomad! -- as a "password" will create
a very difficult password to crack. 


Mark Challender, MCSE 
Network Administrator 


-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Exibar
Sent: Thursday, October 21, 2004 10:07 AM
To: joe; full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] Senior M$ member says stop using
passwords completely!

I couldn't picture having to tell my users to type in a 256 character
password.  Let's make it force 20 uppercase, 20 symbols, 20 high-bit
character, 20 numbers as well.   Although it'll be hard to crack, it'll
take
three hours before they can log in once.  and that's with 2 phone calls
to the helpdesk to unlock their accounts after they entered their
password wrong 3 times in a row. :-)

   Use a secure-ID key fob with a PIN, along with your usual
Userid/password combination.  You'll have a pretty secure login at that
point.

  Exibar

----- Original Message -----
From: "joe" <mvp () joeware net>
To: <full-disclosure () lists netsys com>
Sent: Thursday, October 21, 2004 11:32 AM
Subject: RE: [Full-disclosure] Senior M$ member says stop using
passwords completely!


Well I don't think anyone is saying that the issue is that 128
character
passwords are being easily hacked so I am not quite sure I understand
your
point about 256 characters and why you mention it. People seem to
dislike
passwords greater than 14 characters let alone entering passwords of
150 ,
200 , or 250 characters. To put it another way, if MS suddenly
increased
the
buffer to allow for hashing of passwords 1024 characters in size would
you
push that MS was more secure based on that? I doubt it, I certainly
wouldn't.

BTW, I tried the link someone previously gave with the password hash I
previously posted and it is well under 128 characters and the web site
reported:

Password: not found!


  joe



-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Eric
Paynter
Sent: Monday, October 18, 2004 1:32 PM
To: full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] Senior M$ member says stop using
passwords
completely!

On Sat, October 16, 2004 5:25 pm, Tim said:
The reason for my post was to point out that Mr. Hensing doesn't
appear to be a reliable source of information on the topic of
passwords and hash security.

I think that much became apparent when Mr. Hensing took sarcastic
shots at
Linux security (e.g. "Attack easier targets like all those Linux boxes
you
installed because its so much more secure . . ."). Funny thing is,
Linux
supports up to 256 character passwords by default - twice as long as
Windows.

-Eric

--
arctic bears - email and dns services
http://www.arcticbears.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • RE: Senior M$ member says stop using passwords completely! Mark Challender (Oct 22)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault