Re: Display User Password?

Security was fairly weak on the S/38.   DSPUSRPWD was fast because passwords
were stored in plain text.  The single level signon (enter password only)
required that passwords to be globally unique.  This made for an interesting
situation when you couldn't change you password to a specific value.


There really isn't a big necessity to display a password.  If you don't know
it, then just change it.  Passwords should be set to expire anyway.


Cracking passwords can be easy if QPWDLVL is set to retain the
windows98/lanman passwords (default).   Hacker software like L0phtCrack can
decrypt them without much effort.

Going to QPWDLVL = 3  (128 byte passwords, no windows/lanman passwords)
should be considered.  It will make brute force attacks much harder.



Keith





----- Original Message ----- 
From: "CZE Midrange" <CZEMidrange@xxxxxxxxxx>
To: <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, September 28, 2004 8:23 AM
Subject: Display User Password?


>
>
>
>
>
> Once upon a time...
>
> a long time ago...
>
> in a galaxy far, far away..
>
> existed the dinosaur known as system 38...
>
> with a command to display all the passwords for all the system user
> profiles. I cannot find anything looking like this now on my release 5.3
> box...does anyone know of a way to display passwords in our current world?
>
> Thanks much.
>
>  Rick Rayburn
> NYC
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>