Re: Password Cracking

[Miles Stevenson <miles () mstevenson org>]

<snip>
> I am calling this vulnerability Strong Passwords but Weak Systems.
</snip>

A good variation on this kind of attack is the slew of recent phishing 
attempts hitting your inbox on a regular basis. This and other forms of 
social engineering make password complexity irrelevant.

This is another good example of why it is not a good idea to rely on passwords 
for authentication. As a general practice, I try to keep password 
authentication as a last resort solution. Asymmetric cryptography (pub/priv 
keypairs) is my usual perferred solution, although skey, and other forms of 
biometrics are other alternatives that can sometimes be more appriopriate 
depending on your situation. My philosophy is that if it relies on passwords 
for authentication, its getting wrapped inside a VPN tunnel with better 
authentication mechanisms. 

-- 
Miles Stevenson
miles () mstevenson org
PGP FP: 035F 7D40 44A9 28FA 7453 BDF4 329F 889D 767D 2F63

Attachment: _bin
Description: