RE: Display User Password?

["Hall, Philip" <phall@xxxxxxxx>]

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
> Subject: Re: Display User Password?
> 
> Can be done.  Don't know how.  However if you GO SECTOOLS I believe there
> is a tool there to guess if users have easy to guess passwords.  If not,
> freebies are available from NETIQ, and others, to entice you to look at
> their security products.  I don't believe they come right out and say what
> those passwords are.  But if they can figure it out...
> 

Rob,

In most instances these products normally work in the opposite way. Instead of 
decrypting the existing password to see if it is 'easy', what they normally do 
is have a 'dictionary' of pre-encrypted words, sayings, etc. Plus a way to 
dynamically create encrypted 'passwords' based upon the current system (i.e. 
form user-ids on the system, etc.) the tool is running on.

It's then a simple process of comparing the active encrypted passwords on the 
system against the product's 'dictionaries' of encrypted 'things'.

No user-id passwords are decrypted in the process - it would take too long to 
do it that way on the iSeries, since it take somewhere in the region of 20 
minutes plus do decrypt just *one* iSeries password on a fast PC. The iSeries 
just doesn't have the - or more correctly the right kind of - processing speed.

--phil