Validation flaw addressed in version 2.14

1. Please don't use MS Access (in particular) and any other proprietary DB 
system in general.

They all have security weaknesses - some more than others (my employer has 
decreed that MS Access is 'no more' within our very large financial 
institution).

Whilst most vendors "eventually" fix exposures - there is no guarantee.

PW's database is, in general, so small not to warrant the use of a DB system.

2. As to ciphers.....I would either like a heavily used & internationally 
approved cipher (e.g. AES or 3DES) rather than a lightly used cipher (e.g. 
blowfish, twofish).  Not that they might not be good enough but that more 
use "generally" implies more testing and validation for problems/issues.  Other 
products, support multiple ciphers (and some don't even save a field indicating 
which one was used - it just tries many until one works or none work.  Very 
difficult to break encryption when you have no idea which cipher was used!).
I suspect this would slow down a brute force attack - how much I suppose 
depends on the number of ciphers.  This could be further increased by using 
different combinations from the hash value e.g. swap the two halves around.  
The information on the cipher and how the hash is actually used only needs to 
be known whilst the database is open, doesn't need to be saved within the 
database and can be forgotten between uses.

Hope this makes sense.

David
-- 


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click