Re: How to preserve password change date

Vernon,

1) CHGUSRPRF PWD(AAAAAAAAAA)
2) Call API to get "encrypted" value - lets say it's "F$34FSA09LSK"
3) Write a record with AAAAAAAAAA and F$34FSA09LSK
4) CHGUSRPRF PWD(AAAAAAAAAB)
5) Call API to get "encrypted" value - lets say it's "LKSN)33LAJN"
6) Write a record with AAAAAAAAAB and LKSN)33LAJN
7) CHGUSRPRF PWD(AAAAAAAAAC)
8) You get the idea......

Later you could retrieve someone's encrypted password and lookup their
unencrypted one.

1) Call API to get "encrypted" value - lets say it's "F$34FSA09LSK"
2) Lookup value in table created above.
3) Unencrypted value must be AAAAAAAAAA

Please, someone prove me wrong.
-Walden
-----Original Message-----
From: Vern Hamberg <hambergv@goldengate.net>
To: MIDRANGE-L@midrange.com <MIDRANGE-L@midrange.com>
Date: Tuesday, November 18, 1997 5:40 PM
Subject: Re: How to preserve password change date


>At 06:10 AM 11/18/97 -0800, you wrote:
>>At 06:36 PM 11/17/97 -0500, you wrote:
>>>Booth,
>>>
>>>There is a suite of password APIs that allow you to retrieve the
ENCRYPTED
>>>value of a users password and then use that value to set the user's
password
>>>at a later date/time. Thus it is now possible to "retrieve" a user's
>>>password. Notice that the original post did not want to see the
unencrypted
>>>value, which you cannot do.....maybe.....
>>>
>>>My biggest question is this: Does the word "PASSWORD" always resolve to
the
>>>same encrypted value?
>>Yes.
>>
>>If so, couldn't I retrieve the encrypted password, do
>>>a reverse lookup into a table of plain to encrypted values and retrieve
the
>>>clear text password for the encrypted value? It may take me a few weeks
of
>>>machine time to build this table of clear to encrypted values, but it
could
>>>be worth it.
>>
>>Yes again. A 'dictionary hack' is now a much more feasable endeavor.  All
>>the more reason for enforcing non-trivial passwords.
>
>But where is, and who builds, this table? It doesn't exist on the system,
>so you'd have to build it yourself (which _could_ be done).
>
>OTOH, does the above-mentioned API return the encrypted value itself, or
>some further-muddled version? You have to have the matching API to set the
>password. I don't think it's as easy as it sounds—least I hope not!  :^)
>
>Cheers
>
>Vernon Hamberg
>Systems Software Programmer
>Old Republic National Title Insurance Company
>400 Second Avenue South
>Minneapolis, MN 55401
>(612) 371-1111 x480


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
| Questions should be directed to the list owner/operator: david@midrange.com
+---