🚀 go-pugleaf

vulture@imperial.ac.uk (Thomas Sippel - Dau) writes:

...

>Maybe someone could write a password program that posts all passwords
>to the net when they are changed, for a (hopefully automatic) inclusion 

I'm suprised someone hasn't pointed out the obvious flaw in this: there is
no check for a "good" or "bad" password. Now the output from Crack, that 
would be another story. This scheme would publish (and therefore invalidate)
perfectly good password choices.
	A good suggestion that I heard at the LISA massive migrations workshop: 
run your dictionaries through the Crack rules, saving the generated output,
sort and unique it (and I assume truncate it to 8 characters to save space), 
then use that (and a binary search algorithm) as the dictionary search for 
npasswd or passwd+. You would probably want a central password checking
server, or to be able to NFS mount a single copy of the dictionary in order
to make space reasonablei (but even if not, disk is cheap!).
	The final dictionary size this person was running was around 100megs 
of words, not all that much space for a more secure system. I certainly
intend to take this suggestion (since Crack will find passwords that even my 
somewhat more paranoid version of npasswd will allow ...). 
	Gene: if you would like to take credit for this or offer code, please 
feel free ...

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada