Re: AS400 Automatic Sending of New Password?

I have to disagree....

It's one thing to say that a system has decryptable passwords, whose
encryption you can brake, thus gaining access to any account.

vs. saying that individual accounts with weak passwords could be broken or
compromised via dumpster diving or social engineering.


Charles

On Mon, Jun 22, 2009 at 4:23 PM, Walden H. Leverich <WaldenL@xxxxxxxxxxxxxxx

wrote:

You have effectively decrypted some those words, but have not broke

the encryption.

Your own use of the word 'decrypted' shows there's really no difference.
Whether you get the password by mathematically breaking the encryption,
by a brute-force dictionary attack, by dumpster diving, or via social
engineering (asking the user for the password -- actually works quite
well) the result is the same, you now have access to the system. While
the distinction may be one your PhD thesis advisor appreciates, your
customers whose credit-cards are now compromised, the press, and your
auditors are much less likely to care about the difference. :-)

-Walden

--
Walden H Leverich III
Tech Software
(516) 627-3800 x3051
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.