🚀 go-pugleaf

In article <Bs41qE.1Hy@news.cso.uiuc.edu> jvmg9796@uxa.cso.uiuc.edu (Doc) writes:
> >2) it is contrary to the author's philosophy of BBSing.  That is Frank
> >didn't really go for "The Sysop as big brother"
> 
> Yes, and along with that philosophy, SL doesnt even let the sysop see
> the users' passwords.  A sorry "feature" indeed.  That says "well we
> dont trust you and we think that you might share your users' passwords
> with other sysops so you arent allowed to see."  
> So when a user forgets his password and asks you what it is, you look
> like an idiot having to tell him "I dont know, I can only reset it
> for you."

Searchlight hashes each user password into a 3 byte string when the user
first signs up.  And when the user next logs in it hashes what
they enter and compares it with the 3 byte string.  So it's not
really possible to tell you the password given this storage method.

One disadvantage of this method is that many strings willl
hash to the same 3 byte string .. so if FRED is your password then
Q@@#FG may also work.  The hash method is detailed in the early
shareware versions of SL -- including Pascal source, it's
supposed to irreversable (i.e., you can't get original pwd
from 3 byte number).  I've got a program here whichj a friend wrote
which will take the pwd file and give you lots of strings which hash to
any 3 bytes .. so given a user's 3 bytes in the pwd file it willl
give you some valid passwords -- most of them being nothing like
the original pwd.  But if you combine it with an english dictionary
then you can get back any passwords that were english words.
Actually, it usually gives you several valid english words which
are equivalent to any password!

I think it is a good system for hiding passowrds -- it stops
the dishonest sysops who use users passwords to get onto
other systems where users use the same pwd.  But the 3 byte
method isn't very secure, he should change it to something
like Rivest's MD4 or MD5 algorithms.
-- 
Pat Cain, PO Box 2060, Wellington, NZ  ()  em: cain_p@kosmos.wcc.govt.nz