RE: Where are Windows "Enforce password history" passwords stored?

Wil.Allsopp_at_ins.com
Date: 08/30/05

  • Next message: Adam Chesnutt: "Re: Business justification for pentesting" 
    Date: Tue, 30 Aug 2005 21:59:03 +0100
To: <pen-test@securityfocus.com>

    James Leighe [jamesleighe@gmail.com] wrote:

    >It's stored as a hash, so if you find out how to access them, you
    >would have to crack it. So basically, it's not worth the time when an
    >attacker could just go for the current password.

    This shows a fundamental misunderstanding of security as well as the way
    hackers think. There are many advantages for an attacker to have your
    previous passwords - passwords are reused and some may be current on
    peripheral or entirely separate systems.

    Wil

  • Next message: Adam Chesnutt: "Re: Business justification for pentesting"

    Relevant Pages

    • Re: Password / access rights check
      ... >> knowing their passwords. ... knowledge of a user's access level. ... One reason why you might care is that it ... allows the attacker to focus their attacks only on those accounts with the ...
      (sci.crypt)
    • Re: a way psuedo random numbers can be used in cryptography
      ... multiplies it together. ... Well, the first problem is multiple passwords all create the same seed, ... The attacker knows this is a letter going to Alice. ...
      (sci.crypt)
    • US-CERT security awareness tips
      ... the US-CERT recently started offering security ... Choosing and Protecting Passwords ... what attacker cares about your ... One of the best ways to protect information or physical property is to ...
      (Security-Basics)
    • Re: [Full-disclosure] Google Talk cleartext credentials in processmemory
      ... operating system already presents a means to protect against one process snooping on the other, as has already been pointed out elsewhere in this thread. ... Since application developers are lazy they're going to expose those passwords to every tom, dick and harry who gains access. ... The longer an attacker has to wait for something the greater the ...
      (Full-Disclosure)
    • Re: MD5 and SHA-0 collisions
      ... >>authenticating that you have the secret key. ... hashes of passwords to avoid storing passwords in the clear. ... An attacker wanting to run a dictionary search would have to get ...
      (sci.crypt)