Re: AS400 user password

["Leif Svalgaard" <leif@xxxxxxxx>]

From: Al Barsa, Jr. <barsa2@ibm.net>
> Essentially no.
> There are some hackers who claim to crack AS/400 passwords with brute 
> force, but the risk of this kind of attack will always exist, unless IBM 
> extends the character set or length of passwords in the future.
> 
> Al

Passwords are stored on the AS/400 in encrypted form.
There is an API to retrieve the encrypted password.
The encryption method is DES. Due to the limited
character set allowed in passwords, the password
can be decrypted on a modern PC in a few hours.

BTW: if you apply any or all of the rules for passwords 
controlled by the QPWD* system values, you make
the decryption easier as you diminish the key space.
A long password is not more secure than a short
password.



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---