New answers tagged

1

There are two reasons I can think of: First, because it weakens the main use case. An explicit design goal of scrypt is to make parallelization hardware expensive - and by "hardware" here, we do not mean merely GPU, but also FPGAs and, ultimately, custom ASICs. Building fast-access RAM close to the processor cores necessary to do the calculation is ...


2

You can create your own JtR rules to generate your wordlist. Create a local john-local.conf file in your working directory, so JtR will include it, giving you the option to run rules defined therein: ~/$ cat john-local.conf [List.Rules:myrule] # as-is : # append a number : $[0-9] # append 2 numbers : $[0-9]$[0-9] # prepend a number : ^[0-9] # prepend 2 ...


1

See the links below for details about several bugs that were reported in 2019 concerning weak random number generation, and a flaw in the way that the IV is generated, in versions of 7zip at that time: https://threadreaderapp.com/thread/1087848040583626753.html https://sourceforge.net/p/sevenzip/bugs/2176/ It seems that these bugs have been fixed in later ...


0

People come back to things they know, so if you force the employees to change passwords periodically, most likely, they will start to generate patterns and/or rotate their passwords. A plausible attack may start by using social engineering to impersonate both end-users and help-desk personnel to obtain information regarding procedures, recommendations, ...


4

Microtime() is an incremental value, not a source of random values (quite the opposite). Using this as a source of randomness causes the output to be... More predictable. It drastically reduces the key space of your hash method to a range that can be guessed reasonably well. Your colleague generates their hash using md5(random()), you md5(microtime()). To ...


1

First estimate what would it cost you or your users if smb. has really has got access to the data of some of your users. Will this user lose 1 000 000 USD or will it just lose a few emails inviting to the local bowling club? Then estimate of somebody will really want to invest time and other resources to break your system. If there is no sense for an ...


2

The reason why recommendations for years is to stop passwords from expiring is to prevent people from doing what they normally do: mypasswordJune. If you know that a large section of the user population is changing their password on June 1, then you can start creating password databases based on common patterns and adding: summer june etc. So the big ...


Top 50 recent answers are included