🚀 go-pugleaf

dsiebert@icaen.uiowa.edu (Doug Siebert) writes:

>With that kind of logic why bother with security at all?  

Now now. Calm down. I don't think my logic makes me that much of a kook.
I want an unCrackable password file. I haven't yet come up with how to 
get one. npasswd, which has been defended nicely here since I first posted,
doesn't seem like the way to get an unCrackable password file. Nobody
wants draconian security measures that get in the user's ways, so what
we need is a simple elegant way to get an unCrackable password file.
There may not be a simple elegant way to get an unCrackable password file. 
That doesn't stop us from looking for one. 

>If you really do check a 800,000 word dictionary with 300
>transmorgrifications each a cracker would have to work a REALLY long time to
>get even one password

It takes a long time to run to completion, but it doesn't take long at all 
to get lots of passwords. After the first rush of easy-to-guess passwords
spews out (these are the ones I would expect npasswd to cut down on) then
harder ones continue to dribble out for days. I wouldn't expect npasswd
to make that much of an impact on these.  npasswd is a good thing in its 
own light, but I always thought it sprang up as a (flawed) way to fight crack. 

I'll try to scrounge up the time (to convince a graduate student :-) to 
graft crack to npasswd (seems like someone would have already done that) 
and then hook it to our 800,000 word dictionary and 300 rulesets and see 
how long it takes. Already this discussion has suggested some optimizations 
on how to zip through the rulesets.

-Mike

Humorous aside: A local user set his password to a ``random'' string
of lower case letters. While Crack was going through the rock-star 
dictionary, and was checking for the drummer of Metalica backwards, it
got him!