Re: AS400 user password

["V. LeVeque" <vleveque@xxxxxxxxxxxxx>]

If this helps, most common password crackers in the UNIX world start with
easy and obvious passwords then move up to "harder" ones.  Hence, if  your
password equals your user ID, it will be cracked in seconds.  If the
password is a common dictionary word, maybe some minutes to a few hours.
Arbitrary characters could take days.

Assuming a hacker is an opportunist, they will give up and go elsewhere if
it takes too long.  Also, if you are monitoring your system & find out
you've been attacked, good passwords will buy you enough time to change all
the passwords before the old ones could be cracked (if you look at your logs
daily, know enough to find evidence of an attack and have the power to
change passwords on the spot).

This is why in UNIX environments, a good password is a completely random set
of characters.  It defends against a type of off-line cracking using easily
available tools, and assumes the attacker lacks patience.

Note that none of this may apply in this case.  I'm only explaining the
rationale behind the conventional wisdom.


At 11:55 AM 6/11/00 -0700, you wrote:
>Leif,
>
>Leif Svalgaard wrote:
>
>>
>> BTW: if you apply any or all of the rules for passwords
>> controlled by the QPWD* system values, you make
>> the decryption easier as you diminish the key space.
>> A long password is not more secure than a short
>> password.
>
>I know that you qualified your comments here, but it bears emphasizing....
>
>For the purposes of a brute force attack, a long password may not be more
secure
>than a short password, but the QPWD* values assist in preventing other kinds of
>attacks... specifically those that are aided by trivial or common passwords.
>Setting rules that prevent password recycling, the use of dictionary words, or
>the awful habit of appending a digit to the end of the last password, will help
>keep passwords from being easily guessed by just anyone who happens by.
>
>jte
>
>
>--
>John Earl                               johnearl@400security.com
>The PowerTech Group                     206-575-0711
>PowerLock Network Security              www.400security.com
>--
>
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com
>+---
>
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---