Re: Please do not change your password

[Matthew Gracie <graciem () CANISIUS EDU>]

Koerber, Jeff wrote:
> I agree.  If I can get a list of usernames and know the name of the
> organization and the password strength policy, I could come up with a
> few likely passwords and try them against every account.  Chances are
> that I will come across at least one account with that password.  The
> accounts will never get locked out.

Here's a fun auditing exercise - assuming that your organization uses
some sort of standard schema for generating initial passwords, write a
wordlist and a rule for John the Ripper or something similar that tests
that specific schema. Prepare to be amazed as you realize what a tiny
fraction of users ever change their passwords. Ever.

--Matt


--
Matt Gracie                         (716) 888-8378
Information Security Administrator  graciem () canisius edu
Canisius College ITS                Buffalo, NY
http://www2.canisius.edu/~graciem/graciem_public_key.gpg