Re: Passwords & Passphrases

[Randy Marchany <marchany () CANDI2 CIRT VT EDU>]

We've been using a tool called "ophtcrack" to break into systems where the
user forgot their passwords. It uses Rainbow tables to guess passwords and so
far on Windows boxes, we've successfully retrieved up to 12 character
passwords within 10 minutes. The passwords followed our guidelines. This tool
does require physical access to the machine. Special characters can
significantly lengthen the guess time but basically, we need to find another
way to authenticate (2-way authentication AKA the ATM card/pin code model) in
the long term.

        -Randy Marchany
        VA Tech IT Security Office and Lab