Re: Minimum password length

From: Jim Franz <franz400@triad.rr.com>
> >cracking...
> many don't want to talk about this in a public forum...   as far as i know
> it's never been cracked,

this was in the archives a couple years ago. Yes, it has been cracked.
e.g. http://inet.uni2.dk/~svolaf/
It was easy to crack as it was just Microsofts stupid scheme.

> but some security vendor's products can check if you have easily to guess
> passwords (without
> cracking), kind of a dictionary match.

I know (I wrote it)

>
> suggestion - read the Tips and Tools for Securing Your iSeries
SC41-5300-05
> (page 25 has
> recommended  System Values to stop stupid passwords (expiration, require
> digits, limit repeating
> characters, repeating old passwords or similar passwords, etc).

any restriction on a password (e.g. minimum length, limit repeating, require
digits, etc) just decreases the search space and makes the password easier
to crack. The only solution is not to use Microsoft's scheme and start
using the new 128-character password. The price for that (I think) is it
becomes harder to use AS/400 with  Windows.