× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  • Subject: Re: AS400 user password
  • From: "V. LeVeque" <vleveque@xxxxxxxxxxxxx>
  • Date: Sun, 11 Jun 2000 21:45:20 -0700

If this helps, most common password crackers in the UNIX world start with
easy and obvious passwords then move up to "harder" ones.  Hence, if  your
password equals your user ID, it will be cracked in seconds.  If the
password is a common dictionary word, maybe some minutes to a few hours.
Arbitrary characters could take days.

Assuming a hacker is an opportunist, they will give up and go elsewhere if
it takes too long.  Also, if you are monitoring your system & find out
you've been attacked, good passwords will buy you enough time to change all
the passwords before the old ones could be cracked (if you look at your logs
daily, know enough to find evidence of an attack and have the power to
change passwords on the spot).

This is why in UNIX environments, a good password is a completely random set
of characters.  It defends against a type of off-line cracking using easily
available tools, and assumes the attacker lacks patience.

Note that none of this may apply in this case.  I'm only explaining the
rationale behind the conventional wisdom.


At 11:55 AM 6/11/00 -0700, you wrote:
>Leif,
>
>Leif Svalgaard wrote:
>
>>
>> BTW: if you apply any or all of the rules for passwords
>> controlled by the QPWD* system values, you make
>> the decryption easier as you diminish the key space.
>> A long password is not more secure than a short
>> password.
>
>I know that you qualified your comments here, but it bears emphasizing....
>
>For the purposes of a brute force attack, a long password may not be more
secure
>than a short password, but the QPWD* values assist in preventing other kinds of
>attacks... specifically those that are aided by trivial or common passwords.
>Setting rules that prevent password recycling, the use of dictionary words, or
>the awful habit of appending a digit to the end of the last password, will help
>keep passwords from being easily guessed by just anyone who happens by.
>
>jte
>
>
>--
>John Earl                               johnearl@400security.com
>The PowerTech Group                     206-575-0711
>PowerLock Network Security              www.400security.com
>--
>
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com
>+---
>
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---

As an Amazon Associate we earn from qualifying purchases.

This thread ...


Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.