RE: Retrieve System i user's password?

Steve,


Well, you can not "exactly" retrieve a password, but you can come close
in many instances.

Because the password protection algorithm is a one-way hash, it's not
possible to decrypt the password from the store. The common way to
accomplish something similar is to do a dictionary check of the existing
passwords to see if you can find a match (where you encrypt a large
number of words and then compare each encrypted value to the actual
password - if you get an exact match, you've found a password). This
will tell you if a password is some combination of well known letters
and numbers (which might be what you want to know). If it isn't, then
the theory is that it is more secure than the average password.

If you really want to do an actual dictionary check against your current
password store, send me a note and I'll show you a product that does
this.

Thanks,

jte



--
John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx




Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.

===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
bounces@xxxxxxxxxxxx] On Behalf Of Steve Landess
Sent: Monday, August 06, 2007 10:07 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Retrieve System i user's password?

All -

Correct me if I am wrong, but it is my understanding that you _cannot_
retrieve the password for an AS/400 - iSeries - System i user profile.

My

client's security department wants us to change our password "reset"
program to retrieve the user's password if they indicate *SAME, and

change

it to lower case. As far as I know, this is not possible...

Regards,
Steve
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.