From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00,INVALID_MSGID autolearn=no autolearn_force=no version=3.4.4 X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 103376,2ea9abfbe071a56f X-Google-Attributes: gid103376,public From: "Samuel T. Harris" Subject: Re: Saving and Encoding Passwords Date: 1999/11/29 Message-ID: <3842BAD5.E79640AF@hso.link.com>#1/1 X-Deja-AN: 554492361 Content-Transfer-Encoding: 7bit References: <38315e1a.0@silver.truman.edu> <87u2m8exf8.fsf@deneb.cygnus.argh.org> <1999Nov27.093947.1@eisner> X-Accept-Language: en Content-Type: text/plain; charset=us-ascii Organization: Raytheon Scientific & Technical Services Mime-Version: 1.0 Newsgroups: comp.lang.ada Date: 1999-11-29T00:00:00+00:00 List-Id: Larry Kilgallen wrote: > > In article <87u2m8exf8.fsf@deneb.cygnus.argh.org>, Florian Weimer writes: > > > It is considered close to impossible to recover the password from > > the hash value if the cryptographic hash function is one of the most > > commonly used and thoroughly analyzed (i.e. MD5 or SHA-1). > > But that consideration is only of interest to mathematicians. > > Security folk realize that passwords freely chosen by humans > are highly susceptible to brute force guessing attacks. The > common defenses are: > > Include a secret per-user pseudo-random seed number > in the hash, to prevent pre-computation of hashes for > a particular username. > > Enforce rules regarding password choice that effectively > prevent the use of dictionary words (e.g., punctuation > and numeric characters required). > > Larry Kilgallen A third alternative is to not let the user select the password at all. I remember using WWMCCS (World Wide Military Command and Control System) computers and the password was a 20+ character sequence generated randomly. Classified users had to memory this beast or keep it stored double sealed in the classified vaults. Some users needed access to several nodes in the system. Each node had its own password for that user. What a pain that was, but necessary for a secure environment. It could take 20 minutes to get your password list and get logged in, do 5 minutes of work, and then take 10 minutes resealing your password list and getting back into the safe. -- Samuel T. Harris, Principal Engineer Raytheon, Scientific and Technical Systems "If you can make it, We can fake it!"