As Bruce Schneier says, “oops.”
Encryption is not a silver bullet. How many times do we geeks have to say it? Passwords that can be found in a dictionary (come on, “progress”?!) are ridiculously easy to break. Wake up, people!
As Bruce Schneier says, “oops.”
Encryption is not a silver bullet. How many times do we geeks have to say it? Passwords that can be found in a dictionary (come on, “progress”?!) are ridiculously easy to break. Wake up, people!
And in a related vein: a list of passwords you shouldn’t ever use.
I once had a friend who had forgotten his password on another friend’s BBS. The second friend looked it up… and it was “password”. Live and learn. 😉
Little late with this reply… I used a not-very-common but dictionary based root password for a system running Debian Sarge (or was it Woody?) which had a ssh daemon listening with root login enabled (something that should never be done, you should always log in ssh as a user and su to root if necessary, or better yet use sudo like OS X or other systems like Ubuntu that picked that up… 🙂 ) anyhow, to make a long story short, I was rootkitted three ways to sunday after someone cracked my password via brute force, simply because I used a word that was in the dictionary and didn’t use a program to lock out people trying to do that also. So, moral of the story is, never use a dictionary word, or anything involving one directly, as a password. Not even something “clever”, because someone running passwords through a 15,000+ word dictionary and a distributed password crack attack remotely, or a passwd file scan locally, will find it. (Though better operating systems use shadow passwords now which puts a slight crimp in that…)
I hadn’t heard of “shadow passwords” before, so I looked it up. I found an old article that explained them. How old? Well, this quote should give you a good idea:
🙂
Some *nix operating systems, including Linux, didn’t have shadow passwords when other Unixes did; and even when Linux did it was not the default out of the box on many systems because whoever configured the distro wanted it to be “easy to maintain”. It was long enough ago to be within my memory.
Oops, sorry for the bad italics, apparently “*nix” (star-nix) triggered it..
I fixed the italics. And yes, the asterisk triggered it — see the Syntax Cheatsheet.