🚀 go-pugleaf

On Fri, 17 Nov 2000 03:58:28 +0100, "Bj�rge S�ther"
<REMOVE_bsaether@THIS_online.no> wrote:

>
>This is one of the most paradox-al facts about computers and security:
>- Whenever I get back to a customer a few years later, the very same old
>password is still valid. They may have installed firewalls or whatever,
>but don't care about whether I get drunk and tell anyone the admin
>password so that a crook has got all he needs...
>
Set a time limit for password validity, so the user is forced to
change it. And when doing so, prevent him from changing to the same
password again. Even better, keep a list of, say, the last 10
passwords used and prevent any of these to become the current
password. Also, require a minimum password length.
Not foolproof, but may help a lot...
>128 bit encryption, my a....;-)
>
>Part from that (which isn't your fault, anyway), a well written,
>informative tech-tip !
>
>A (little) tech tip on the very same topic: Whenever a key is to be
>checked, add (if possible) a noticeable delay, or use an algoritm that
>involves a *lot* of processing. if checking 1 key value takes 1 second,
>a hacker will only be able to test for 3600 keys / hour....
>I once created a password cracker for Paradox. Checking one password at
>a time was hopelessly slow. I seem to remember being able to check 200
>passwords in one pass, this speeded up a *lot*. Anyway, it was too slow
>to crack more than 5-char pwds...;-)
>--
Lock the account after, say, 10 invalid passwords. Unlocking procedure
should include investigation of why 10 invalid passwords were entered.
Of course, this requires some kind of security department or
oficial...
>Bjoerge Saether
>Consultant / Developer
>Asker, Norway
>bsaether.removethis@online.no (remove the obvious)
>
>
>
Pierre Gemis