Subject: Re: (radius) Username/User-Password attributes

From: "Russell J. LeBar" <[email-masked]>
Date: Tue, 27 Oct 1998 17:42:24 -0600

Who says the hacker is hacking his own ISP? Besides, we want to try to avoid
giving hackers clues/exploits, no matter how trivial.

-----Original Message-----
From: Barney Wolff <[email-masked]>

>Without claiming any real expertise, I'll jump in.  I see no added risk
>here - if one assumes the attacker can sniff the packets, it's a triviality
>to know your OWN password, so you can run the same attack by just dialing
>in.  As the shared secret is set up by network operators, not users, the
>use of a short or guessable one is self-abuse.

---

From: Barney Wolff <[email-masked]>
Date: Tue, 27 Oct 1998 20:16:38 -0500 (EST)

Oh, nonsense.  The attacker can always sign up briefly.
Or, if you like, the attack can be done without knowledge of the user's
password just be looking for an all-ascii result after decryption, on
a few captured access-requests.
But even 8 lower-case letters gives 200 billion possibilities, and
mixed case or extending to 12 char puts it out of current technological
reach.  A properly-chosen shared secret is longer than 12 and mixed
case, digits and specials.  Anybody wants to brute-force that, go
right ahead and try.

The best algorithm in the world won't help if you choose "maintenance" as
your password or post-it on the monitor.
Barney

> giving hackers clues/exploits, no matter how trivial.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.