Re: passwords

* Lars Banke <[email protected]> [2008-03-21 12:21:52]:

> Hi.
> 
> I am a window linux user.
> Not pro by any means.
> I Do not like very secure passwords.
> I have watched twice my computer trying to be comprimised.
> Once I took my router off and left smbd open to the internet. something
> was trying to access it.  turned it off life is good. Someting else was
> trying to log into ssh. I turned ssh off with the router and it moved
> on.  
> 
> 
> So why can we not make password authentication slower so that a computer
> program can't crack a 6 letter password in a life time. 
> 
> 
> I can only login as fast a I type. And that is preety slow.
> 
> 

OpenBSD already implements this sort of thing with the blowfish
cipher, however that's only for offline attacks against a hash.
It's designed to be slow and is exceptionally easy to scale with
the advent of faster computers.

Good passwords such as: UTe@#119e3e~ will take you a long way.

Although there are many ways to deter ssh bruteforcing, I use this in pf:
pass in proto tcp from any to any port ssh keep state \
        (max-src-conn 5 overload <bruteforce> flush global)
This is unnecessary for me mostly because of my strong passwords;
I use it mostly for bandwidth reasons.

For authentication over HTTP, for instance, well I'm sure you've
seen different schemes by now.

-- 
Travers Buda