Re: Passwords & Passphrases

[Randy Marchany <marchany () VT EDU>]

We've been using a tool called "ophtcrack" to break into Windows systems where
the user forgot their passwords. It uses Rainbow tables to guess passwords and
so far on Windows boxes, we've successfully retrieved up to 12 character
passwords within 10 minutes. The passwords followed our password strength
guidelines which are fairly standard (upper/lower case, alphanumeric, 8
character minimum). This tool does require physical access to the machine.
Special characters can significantly lengthen the guess time but basically, we
need to find another way to authenticate (2-way authentication AKA the ATM
card/pin code model) in the long term.

        -Randy Marchany
        VA Tech IT Security Office and Lab