🚀 go-pugleaf

In article <1992Jul27.184324.14697@hubcap.clemson.edu> hubcap@hubcap.clemson.edu (System Janitor) writes:
>Unless I am mistaken, npasswd doesn't check for everything crack
>does.  Even dropping the time consuming crypt part, it seems like it
>would take an unacceptable amount of time to change your password if
>it were checked against, say, an 800,000 word dictionary with 300
>transmogrification rulesets.

But remember - if n is the number of words you want to check against
(say, 20000 words * 15 transformations = 300k words), you only have to
do O(log n) comparisons. Your password cracker is going to be doing
O(n) comparisons, and she's going to be doing it through a slow crypt
function. You win.

Furthermore, there's no reason in principle that the crack 4.1 word
generation engine (which is excellent) can't be grafted into npasswd.
I keep hoping someone else will do the work for me.

>The point is, even if you use npasswd, a cracker will still get some
>of your passwords. So what if they only get 10 instead of 200, they'll 
>still have some userids from which to launch their nefarious plans.

yes, but if you have 2000 users and only 10 of the passwords are
crackable, then it will take a *long* time for the "nefarious cracker"
to get at those passwords.

Security is a game of staying ahead, not being perfect.
-- 
                __
nelson@reed.edu \/   Delicious & Nutritious breakfast cereals shot from guns!