Re: looking for a webapp bruteforce video for non-techies

["Robin Wood" <dninja () gmail com>]

2008/6/3 Martin O'Neal <martin.oneal () corsaire com>:
> > It didn't help that the password was only 5
> > characters!
>
> That may not actually be such a bad password (on balance and in
> context).  Sure it is a dictionary/leet word variant, but five
> characters actually carry plenty of entropy (if mixed case and numerics
> are also used).  However, if you have an authentication mechanism that
> doesn't lock out an account and *allows* brute forcing, it doesn't
> really matter how strong the password is; given enough
> universe-lifetimes an attacker will always guess it eventually.

Trust me, it is a VERY bad password in these circumstances!

Robin

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes 
in Securing Web Applications  
Find out now! Get Webinar Recording and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------