equal
deleted
inserted
replaced
482 includes rules that cover cases like \pcode{passwordpassword} |
482 includes rules that cover cases like \pcode{passwordpassword} |
483 or \pcode{drowssap} (password reversed). Historically, |
483 or \pcode{drowssap} (password reversed). Historically, |
484 compiling a list for a dictionary attack is not as simple as |
484 compiling a list for a dictionary attack is not as simple as |
485 it might seem. At the beginning only ``real'' dictionaries |
485 it might seem. At the beginning only ``real'' dictionaries |
486 were available (like the Oxford English Dictionary), but such |
486 were available (like the Oxford English Dictionary), but such |
487 dictionary are not ``optimised'' for the purpose of passwords. |
487 dictionaries are not ``optimised'' for the purpose of passwords. |
488 The first real hard date was obtained when a company called |
488 The first real hard date was obtained when a company called |
489 RockYou ``lost'' 32 Million plain-text password. With this |
489 RockYou ``lost'' 32 Million plain-text password. With this |
490 data of real-life passwords, dictionary attacks took off. |
490 data of real-life passwords, dictionary attacks took off. |
491 |
491 |
492 These dictionary attacks can be prevented by using salts. |
492 These dictionary attacks can be prevented by using salts. |
534 previous section was only secure when the salt was secret. In |
534 previous section was only secure when the salt was secret. In |
535 the password case, this is not needed. The salt can be public |
535 the password case, this is not needed. The salt can be public |
536 as shown above and is actually stored as part of the password |
536 as shown above and is actually stored as part of the password |
537 entry. Knowing the salt does not give the attacker any |
537 entry. Knowing the salt does not give the attacker any |
538 advantage, but prevents that dictionaries can be precompiled. |
538 advantage, but prevents that dictionaries can be precompiled. |
539 |
539 The moral is that you should never store passwords in plain |
|
540 text. Never ever. |
540 |
541 |
541 \end{document} |
542 \end{document} |
542 |
543 |
543 %%% Local Variables: |
544 %%% Local Variables: |
544 %%% mode: latex |
545 %%% mode: latex |