lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 15 Sep 2014 12:49:09 -0400
From: Bill Cox <waywardgeek@...hershed.org>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] PolyPassHash is broken

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/14/2014 06:05 PM, Justin Cappos wrote:
> Will any hashing scheme protect an admin account that chooses
> 'password' or 'abc123' as their password?  (At least PPH protects
> thresholdless accounts even with these horrid passwords.)

Actually, I logged into a system a couple of weeks ago as root, using
"password" as the password, which I guessed out of desperation because
I needed access and the guy who set it up was not available.  There is
simply no defense against such admins :-)

Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUFxiCAAoJEAcQZQdOpZUZoDwP/RljhFFwJ+Z9W0CfXDGbWneZ
wXSDcM9SRhqmipyvC8CkzWGpPChnvg8eNe4xsGbbADaaA4nbOgcsNDPcZqMcFErl
xtofsIu0Vsvwj0rUKavueqvSUOF8nZEaKQH8xuvitSpj5hD8K1dBO1TY/pQ3CFvM
TPu1LFonaP2J7YUNUggr7fg04J7zO5ykw0Mj4574ycLLLKcSJ8O44+rbh2H5VCl3
UhfufUaTBBNdTX8JF2ubOYD2mYx4GdQpVfQhH1z6OS/HW3n5tVOCnpvA+H+BFIRT
PU/DbjKMD1iRUAa4jbN4FNefLfcuJYQ4PptSyXZAV9xkVTSjeepuqCvGLGrQfsoK
A2B9z9lt4urumIsMPZBqDS+JrLQqlw3UXJ5QqameOeLfDHlEejpcUey+LsH4KkMW
4JXPvdX7dlw5W1vPNXfdG4Wp55Hd3Z0tJSGVMJGvTqlfP4JMnvZUpDyCu4ui33F8
EtSiefw0Kn2pzMMyfT+MJAA//oaYY6xgPST3FuESUauq4NrXUCXxSdVgwJ1H2Col
IJK70cuussInYTqboNjRVsH/aqiZQNTRvYQYhcLXxpiLBZAfAE0M6P0MV1IINc/I
D28DMgK3Ibg1f0whWMCa3wo7YJnv4lLd43geNYxIdeEIkhp1aDKfJEUor6FcnsRh
xDA635BjKmuwb5neUCBx
=3ne1
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists