Re: Password encoding

From: Nomad (mailman@crypton.pl)
Date: 09/26/02 

Date: Thu, 26 Sep 2002 20:49:11 +0200
From: Nomad <mailman@crypton.pl>
To: Todor Genov <ukj@unix.za.net>

O, that's nice: I haven't knew about that.Since I do like Blowfish I thought that there are only 2 possibilities in Free: crypto or md5.
 But the main problem is that passwd_format in my login.conf for default user (and new users were appended to that class) is and was "md5". But password encoding for new accounts was "des".
When I added line "auth_default=md5" and changed passwords for those accounts by passwd then encoding format changed to md5.
So: _without my knowledge_ passwords for new accounts were 8 characters long.

On Thu, Sep 26, 2002 at 10:04:37AM +0200, Todor Genov wrote:
> > You're going to want to do 2 things. First, make sure that you have your
> > passwd_format=md5 in your /etc/login.conf (be sure to run cap_mkdb
> > /etc/login.conf after you do so).
>
> FreeBSD has had support for blowfish passwords for quite some time now. Just
> specify passwd_format=blf in login.conf.
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message 

-- 
Nomad
[%% If you dance with devil %%]
[%% you don't changing him. %%]
[%% The devil is the one    %%]
[%% who is changing you.    %%]
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: secure login form
    ... For my point of view I'm thinking of using md5 passwords in db. ... If you want the avoid the man-in-the-middle eavesdropping on you: Then you need https, ... If you are afraid the username/password you store in your database is hacked somehow, then it can make sense to store them with an md5 hash, which is one-way encryption indeed. ... (You can propagate the sessionid from http to https via a form, and let the receiving script use that sessionid for its https session. ...
    (comp.lang.php)
  • Re: secure login form
    ... For my point of view I'm thinking of using md5 passwords in db. ... If you want the avoid the man-in-the-middle eavesdropping on you: Then you need https, ... If you are afraid the username/password you store in your database is hacked somehow, then it can make sense to store them with an md5 hash, which is one-way encryption indeed. ... (You can propagate the sessionid from http to https via a form, and let the receiving script use that sessionid for its https session. ...
    (comp.lang.php)
  • Re: Time-to-crack MD5 passwords
    ... ]>]> customer of, regarding the length of passwords. ... ]> The md5 passwords do not use just md5. ... ]> use an arbitrary length string-- you are not limited to 8 characters. ...
    (comp.security.misc)
  • Re: Current thoughts on system partitioning
    ... > Just to use my specific example, I've built a server with two 160 GB ... In my experience, SuSE by default installs DES encryption for passwords, ... you can switch the SuSE to MD5 ...
    (comp.os.linux.misc)
  • Re: [PHP] md5
    ... It is likely possible to find alternate passwords if the md5 is known - if a user can get a hold of your md5'ed passwords, they may be able to come up with another password that will create the same MD5 hash, thus would be capable of logging in to the system. ... I'd much rather have an algorithm that is well known, well analysed and *still* secure over an unknown and untested algorithm. ...
    (php.general)