RE: Password Management

["Utz, Ralph" <rutz () realtime-it com>]

Regardless of how old the subject matter is that I'm referring to, it's
still the reasoning behind the legacy thoughts of 7 being an optimal
password length. Not to mention your 2k3 DC still uses it. 

-----Original Message-----
From: Derek Schaible [mailto:dschaible () cssiinc com] 
Sent: Tuesday, April 25, 2006 7:04 AM
To: Utz, Ralph
Cc: security-basics () securityfocus com
Subject: Re: Password Management

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 21, 2006, at 4:44 PM, Utz, Ralph wrote:

> The reasoning behind 7 being the magic number is because of how the
> passwords are stored on the DC. Say you have a 9 character password.
> When it is stored, it is broken down into hashes. Each hash is 7
> characters long. So when that password gets stored, it is broken into
> two hashes, one that is 7 characters full, one that only has 2
> characters. The hashes are not padded, so the last hash is weak due to
> only having two characters in it.

You are describing the very old LAN Manager Hash or LM Hash which was  
used in the early days of NT and Win95/98 clients. Modern Windows  
Domains use NTLM, NTLMv2 and/or Kerberos (the default if you have a  
modern Win2K3 domain filled with XP clients) . While each of these  
has their own potential for exploitation (no authentication system is  
infallible), they do not use the LM Hash and Microsoft recommends  
disabling the LM Hash from your domains entirely via GPO's. It is  
still supported by default to support legacy clients but without  
those clients on your network, it won't be used unless something is  
seriously wrong with your authentication scheme.

All that said, usually the longer the password, the better. I say  
usually because BermudaShoreLine will probably be cracked long before  
"15()Lpjs][" would. It's not just length that matters, its content  
and complexity as well.

HTH!

- -d


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFEThAZaMpDBGs574MRAgNYAJ9vz6CUb6UIAD+VENPHXxADEJN4OACfR75H
8mxZ+VwK7RtHDmAtApoQbSE=
=LPif
-----END PGP SIGNATURE-----


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------