Re: AS400 user password

John,

you are, of course, correct. However, my comment was strictly in
response to the brute-force problem. The trivial passwords, common
word passwords, and adding digits to the end can all be defeated
with a dictionary attack, but at least you have to mount an attack
rather than just guessing. The problem is often made worse by
requiring passwords to be changed too often (say once a month).
If you use a *good* password (e.g. S1P7@MDJ) you should be
allowed to keep for a long time.

----- Original Message -----
From: John Earl <johnearl@400security.com>
To: <MIDRANGE-L@midrange.com>
Sent: Sunday, June 11, 2000 1:55 PM
Subject: Re: AS400 user password


> Leif,
>
> Leif Svalgaard wrote:
>
> >
> > BTW: if you apply any or all of the rules for passwords
> > controlled by the QPWD* system values, you make
> > the decryption easier as you diminish the key space.
> > A long password is not more secure than a short
> > password.
>
> I know that you qualified your comments here, but it bears emphasizing....
>
> For the purposes of a brute force attack, a long password may not be more
secure
> than a short password, but the QPWD* values assist in preventing other
kinds of
> attacks... specifically those that are aided by trivial or common
passwords.
> Setting rules that prevent password recycling, the use of dictionary words,
or
> the awful habit of appending a digit to the end of the last password, will
help
> keep passwords from being easily guessed by just anyone who happens by.
>
> jte
>
>
> --
> John Earl                               johnearl@400security.com
> The PowerTech Group                     206-575-0711
> PowerLock Network Security              www.400security.com
> --
>
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---