Re: AS400 Automatic Sending of New Password?

[Charles Wilt <charles.wilt@xxxxxxxxx>]

I have to disagree....

It's one thing to say that a system has decryptable passwords, whose
encryption you can brake, thus gaining access to any account.

vs. saying that individual accounts with weak passwords could be broken or
compromised via dumpster diving or social engineering.


Charles

On Mon, Jun 22, 2009 at 4:23 PM, Walden H. Leverich <WaldenL@xxxxxxxxxxxxxxx
> wrote:

> > You have effectively decrypted some those words, but have not broke
> the encryption.
>
> Your own use of the word 'decrypted' shows there's really no difference.
> Whether you get the password by mathematically breaking the encryption,
> by a brute-force dictionary attack, by dumpster diving, or via social
> engineering (asking the user for the password -- actually works quite
> well) the result is the same, you now have access to the system. While
> the distinction may be one your PhD thesis advisor appreciates, your
> customers whose credit-cards are now compromised, the press, and your
> auditors are much less likely to care about the difference. :-)
>
> -Walden
>
> --
> Walden H Leverich III
> Tech Software
> (516) 627-3800 x3051
> WaldenL@xxxxxxxxxxxxxxx
> http://www.TechSoftInc.com
>
> Quiquid latine dictum sit altum viditur.
> (Whatever is said in Latin seems profound.)
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.