581–590 of 665 posts
Earlier quoted context omitted.
Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.
wow, that's very scummy. That must feel worse than them finding you because you slipped up technically.
I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…
Our high school network ran on Novell NetWare, but I wasn't anywhere near smart enough to crack anything so I just wrote a little program in QBASIC that looked like the NetWare login prompt which rejected all login attempts but dumped what was entered into a text file, and left it running on one of the PCs in the computer room. It wasn't even a compiled program, it was just running inside QBASIC's IDE. Yet it was run…
out &h64&hfe
Instareboot on a DOS machine.
Earlier quoted context omitted.
> Would you still feel safe if a burglar broke into your house and left a note saying they didn't take anything? You might feel safe if he didn’t, but you wouldn’t actually be safe, would you?
Feelings are more important than reality!
Earlier quoted context omitted.
>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still…
Isn't this more like duplicating everyones house key? He never actually went into the houses.
Earlier quoted context omitted.
> If I can crack a DES password in 4 days, I can crack a 3DES password in 12 It's multiplicative, not additive. 3DES is about 2^56 times as difficult to crack as DES. (Not 2^112 times because there is an attack that effectively limits it to twice the effective bits of DES, rather than the three times you might expect at first).
This is mostly irrelevant in the context of password hashing however. We're simply feeding passwords into a blackbox at X/s until we get a match. 3DES runs at approximately X/3 compared to DES. If it takes 4 days to feed a bajillion passwords into DES, it takes 12 days to feed the same number into 3DES.
Earlier quoted context omitted.
> If I can crack a DES password in 4 days, I can crack a 3DES password in 12 It's multiplicative, not additive. 3DES is about 2^56 times as difficult to crack as DES. (Not 2^112 times because there is an attack that effectively limits it to twice the effective bits of DES, rather than the three times you might expect at first).
It's more complicated than this, because there are known attacks against 3DES. It's at most 2^28 times more complex, AFAIK, but there are probably better attacks than the few I know.
Earlier quoted context omitted.
A second-preimage attack is where you want to find m' where h(m) == h(m')... and you know m already. This is not very useful for password hashing; it would give you a second password that would also work to log into the account, but what's the point of that if you already know the first password? The relevant attack for password hashing is a regular preimage attack, where you don't know m (and it would be acceptable…
You don't need to know m, just h(m) which is commonly found in database breaches
This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.
I would avoid doing that, invariably they end up in dumps with your name and email next to them. One of the more interesting things about reused "unique" passwords is they can serve as a fingerprint to link accounts you may not otherwise be able to attribute to the same account/individual.