RE: Need to generate passwords

Why do that? With Ethereal and some time, he can get any AS400 password he
wants.

-----Original Message-----
From: Leif Svalgaard [mailto:leif@leif.org]
Sent: Thursday, October 24, 2002 10:45 AM
To: midrange-l@midrange.com
Subject: Re: Need to generate passwords


From: Leif Svalgaard <leif@leif.org>

> From: Booth Martin <Booth@MartinVT.com>
> > Please explain why what you've described isn't the same as a better
> > lock on the henhouse door after the fox is already living inside the
> > henhouse.
> >
>
> Because most (urban legend has it at 80%) of attacks come from
> insiders. They know what is valuable and worth going after.
>

My answer was not good. Here is another go: an attacker may
get a hold of information needed to allow a dictionary attack if
he gets lucky (QSECOFR left the terminal signed on while taking
a p-break...). Later on, the attacker can use that for a dictionary
attack (maybe even using his PC). Having gotten the passwords
of important users, he can then later on impersonate these
and the machine couldn't tell the difference. The goal is to
make a dictionary attack infeasible, by
1) not use words coming from a dictionary
2) use upper and lower case to enlarge the keyspace
3) use one or two special characters to do same

The main point is: DON'T START FROM A DICTIONARY.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.