Re: obtain user's password?

From: Keith W. McCammon (km_at_km.com)
Date: 06/02/03 

Date: Mon, 2 Jun 2003 08:58:30 -0400

> I have yet to see an application that can return an actual valid password
> that a user has used.

L0phtcrack.

> I wont go into how these cracking apps work with passwords , but they
> certainly don't return an actual password....

Sure they do. It's a hybrid brute-force/dictionary attack. The app just
keeps guessing until a match is returned.

> I have been asked to supply passwords to an owner of a company and the
only
> way I would do it was have hime sign a waiver on security on all the
people
> he held passwords for.
> Imagine if one of those passwords was used by an accountant for online
> banking etc, you can imagine what trouble there would be if it got out...

Yep. Managing passwords is a generally awful idea, unless there are *very*
good reasons for doing so, and *very* strict controls (i.e., the nuclear
football :)...

Relevant Pages

  • Re: SQL Access security from Window Application
    ... you could have your app handle authentication by emulating the ... Currently my application access the SQL using ... >System.Data.SqlClient and all forms use stored procedures. ... >passwords in a protected file but this creates a problem on remote systems ...
    (microsoft.public.dotnet.general)
  • ASP.NET security question
    ... I'm building an ASP.NET app that will access a SQL2000 ... on the web server box for the trusted account but I still ... know that passwords used in forms authentication can be ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: app to send and receive file over a network?
    ... to run the app and wait that the file is sent. ... scp and setup ssh keys so a password is not required ... ncftpput to automate ftp with passwords in the command line or config file. ...
    (comp.os.linux.networking)
  • Re: ASP.NET 2.0 forms auth: default user
    ... passwords are not encrypted but hashed - you can call the CreateUser SPROC as part of your DB setup. ... Dominick Baier - DevelopMentor ... I would like to deploy a web app which uses forms authentication. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Guessing passwords with Hydra
    ... This type of password guessing needs preparation. ... rarely have time for a *real* brute force attack. ... passwords are fairly high on the list, some years back Babylon, Star Trek ... can easily produce such lists by program or by one of several ...
    (Pen-Test)