Re: Stanford break in

[Carric Dooley <carric () com2usa com>]

On Thu, 22 Apr 2004, Chuck Vose wrote:

<snip>
> something like the I like fuzzy bunnies (only 7 characters long with a
> number and a special character.)
>
> Anyone had any experience with this sort of thing?

Yes. There are password generators that create 'pseudo-english' words, but 
I think the best system is using something the user knows/likes, providing 
it's not obvious like birhday+daughter's_name... "I like fuzzy bunnie's.." 
is a good example. First letter in each word of a favorite verse in a 
poem, or song lyric, or book, etc. with some special characters thrown it. 
It meets the "non dictionary-based" requirement. This is typically what I 
suggest, and would put in my end-user education program. It needs to be 
easy to remember, and damn hard to guess...

> Also, are salts a good idea to change the hash in the shadow file? 
> For instance, change passwd or yppasswd so that entering ilfb76v is
> equivalent to entering /ilfb76v*. Adding in special characters that
> change the hash and make it harder for brute force to check. Does it
> matter? What are the chances that a hacker would check yppasswd for
> modifications?

Salt would typically be some random factor that affects the outcome of the 
hash. In other words, if Bob and Sarah both pick "deer-pickles" as their 
password, the hashes are totally different... you could use time, white 
noise, or some other pseudo random factor... I am not a cryptologist, so 
I'm sure I sound like an idiot to that crowd... I understand the 
principal. Typically, a password cracker takes strings and hashes them.. 
when the hashes match, you got the original password string, so salt means 
you gotta burn MORE cycles producing hashes from each string. This will 
hopefully take more time than the password aging settings...

> As my teacher friend explained this, he uses access like objects inherit
> in programming. There's the base access which included things like a
> small home directory on a shared server and a roaming desktop with the
> ability to log in on the public computers. However if you're in a
> specific group you get access to the specific computers in that area,
> and the servers that pertain. (I say this more for my benefit and the
> archive's benefit)
This is essentially the principal for directories. Containers,
inheritance, explicit rights, etc. This is the one thing Novell REALLY did
well with NDS (and file and print, of course, my friends in red). I am by
no means a Novell bigot, but I gotta give credit where it's due.


-- 
Carric Dooley
COM2:Interactive Media
http://www.com2usa.com


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards