Why use strong passwords? Post: 302727017

Sponsored Content

Special Forums Cybersecurity Why use strong passwords? Post 302727017 by Neo on Monday 5th of November 2012 01:46:08 PM

11-05-2012

Administrator

Quote:

Originally Posted by Corona688

That only matters when you've swiped someone's shadow file though. If they have to brute-force your login, most systems will slow down failed logins severely.

Well, that is exactly what I said in my first post, that the issue is when someone steals the password file (what ever kind it is), my post was:

Quote:

One reason is that if someone steals the password file with all the encrypted passwords , it is easy to crack weak passwords. So, imagine a business with 20,000 customers and someone steals the password file. It would be easy for a criminal to run a brute force exploit (attack) against the encrypted passwords in the password file, and then subsequently compromise the accounts.

And in reality, this is what happens. A password file or database full of passwords (encrypted) are stolen; this can also include encrypted credit card information and other confidential data.

The same is also true for encrypted WIFI keys, which can be stored as encrypted text and then later on, a brute force attack is applied against those passwords; so the exploit is first gathering the data (encrypted text) and later running an attack against the ciphertext.

Neo

View Public Profile for Neo

Visit Neo's homepage!

Find all posts by Neo

2 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Strong quotes and spaces

We ran into a problem because of a shop that uses Windows and UNIX. The file names that Windows uses have spaces in them. When they get moved to the unix system they still have spaces. This produces a problem in our script that moves them again from one unix system to another. I've made up a...

2. UNIX for Advanced & Expert Users

When did UNIX start using encrypted passwords, and not displaying passwords when you type them in?

I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the...

LEARN ABOUT SUSE

chpasswd

chpasswd(8)						      System Manager's Manual						       chpasswd(8)

NAME

       chpasswd - change user passwords in batch

SYNOPSIS

       chpasswd [-D binddn] [-P path] [-c des|md5|blowfish | -e] [file]

DESCRIPTION

       chpasswd  changes  passwords for user accounts in batch. It reads a list of login and password pairs from standard input or a file and uses
       this information to update the passwords of this user accounts. The named account must exist and the password age  will	be  updated.  Each
       input line is of the format:

		 user_name:password

       If  the	hash algorithmus is not given on the commandline, the value of GROUP_CRYPT or, if not specified, CRYPT from /etc/default/passwd is
       used as hash algorithmus.  If not configured, the traditinal des algorithmus is used.

OPTIONS

       -c des|md5|blowfish
	      This option specifies the hash algorithmus, which should be used to encrypt the passwords.

       -e     The passwords are expected to be in encrypted form. Normally the passwords are expected to be cleartext.

       -D, --binddn binddn
	      Use the Distinguished Name binddn to bind to the LDAP directory.	The user will be prompted for a password  for  simple  authentica-
	      tion.

       -P, --path path
	      The  passwd  and	shadow	files  are  located  below the specified directory path. chpasswd will use this files, not /etc/passwd and
	      /etc/shadow.

FILES

       /etc/default/passwd - default values for password hash

SEE ALSO

       passwd(1), passwd(5), shadow(5)

AUTHOR

       Thorsten Kukuk <kukuk@suse.de>

pwdutils							   Feburary 2004						       chpasswd(8)