Re: New Password rules at VRM610

On 23/04/2008, at 11:29 AM, Mike Cunningham wrote:
> Don't you think the password crackers have figure out the number  
> for vowel trick and are using those variations in dictionary  
> attacks?  I don't think a password of f1shh3ad is any more secure  
> anymore than fishhead. I like passphrases in mixed case for those  
> accounts that need the highest security

Whether they have figured it out or not is immaterial. It will take  
more attempts to brute-force crack a password that omits vowels or  
replaces them with numbers than to crack complete words.

Whether that adds much to the elapsed time of a brute-force attack  
given the current desktop power is a separate argument.

Seems to me the purpose of all password rules is not to ensure  
"uncrackable" passwords but rather to ensure less easily "guessable"  
ones. It is primarily an audit-satisfaction tool.

Given enough time, enough CPU, and enough reason, probably anything  
is crackable--certainly any encryption to which we have access. You  
don't think the US Govt. allowed 128-bit encryption to all their  
"friends" because they CAN'T crack it in a reasonable time do you?

Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.