🚀 go-pugleaf

"someone" <someone@somewherw.from.the.earth> writes:

>I am the admin of this workstation, there are many people using the
>computer, some accounts have admin rights, so they can use the NTcrack to
>get the password of other user (including me) and see their info

>so I wanted to change the hashing rountine to sometime of my own so the
>cannot use NTcrack or l0phtcrack to uncrack the hashed password

That is a *bad* idea, unless you are better at writing secure hash
functions that the Revest of RSA. I think you are not.  Adding some
salt would be a good move though.

NTcrack and l0phtcrack, and all Un*x password crackers including
crack, are based on a dictionary. Given the name, comment, etc and big
dcitionary plug them into the hash function and see if something
matches. If the value does not match try the next idea...

In Un*x you have to talk account of the salt but that is avialable in
the clear, so the same theory works. salt just makes it harder work
because lists of passwords can only be attacked in groups with the
same salt.

Provided you keep your password out of the generated lists the
cracking programs will not be able to find it. However far too much NT
authentication is based on the *hash* and not the password. This makes
it a waste of effort to reverse the hash function---just modify the
client so it accepts hash values instead of passwords and you can
break in without major problems.

To date nobody hash managed to reverse either the NT or the Un*x
password hashing algorithms.

Duncan (-: