Now this is password security

Lusankya

Member

​

Joined

Aug 14, 2002

Location

Da Windy City / Chicago

• Feb 27, 2004

• #1

"Your password must be at least 18770 characters and cannot repeat any of
your previous 30689 passwords. Please type a different password. Type a
password that meets these requirements in both text boxes."

http://tinyurl.com/nnlo

 

tom10167

Member

​

Joined

Oct 9, 2003

Location

Phoenix. YOUR HAIR IS GOOD TO EAT

• Feb 27, 2004

• #2

Wow, Microsoft is taking some HUGE steps in increased security. Good to hear?

 

KaHNZa

Senior Member

​

Joined

Feb 13, 2001

Location

West Central MN

• Feb 27, 2004

• #3

Uh, something tells me that ain't real.

EDIT: Just checked it. Its real.

 

Last edited: Feb 27, 2004

Agent_Mull

Member

​

Joined

Oct 18, 2003

Location

Leawood, KS

• Feb 29, 2004

• #4

ROFL. Wow, thats really extensive. Haxor proof... Almost

 

JigPu

Inactive Pokémon Moderator

​

Joined

Jun 20, 2001

Location

Vancouver, WA

• Feb 29, 2004

• #5

Wow. That's what I call security.

Anybody got a good 18770 character password that's easy to remember? I'm fresh out...
JigPu

 

M

Malpine Walis

Disabled

Joined

Nov 23, 2001

Location

Banned Camp

• Feb 29, 2004

• #6

Department of Ripley's Believe it or Not:

No, that is a real system message and it is actually accurate. The MIT Kerberos system sets passwords on both a per-session basis and a per transaction basis. The requirements are stringent so that there is virtually no chance of hacking them even with cracking software running on a Beowulf system.

 

tom10167

Member

​

Joined

Oct 9, 2003

Location

Phoenix. YOUR HAIR IS GOOD TO EAT

• Feb 29, 2004

• #7

....??? From what I got, that's an error, a bug, not supposed to do that.

*confused*

 

SewerBeing

Grasshoppa Senior

​

Joined

Jan 15, 2004

Location

The truth?? You can't handle the truth!!

• Feb 29, 2004

• #8

jeeze and I thought I was paranoid.

 

M

Malpine Walis

Disabled

Joined

Nov 23, 2001

Location

Banned Camp

• Feb 29, 2004

• #9

Well it is sort of a bug. Kerberos is supposed to hide in the background so that the end user doen't know that it is there. But the passwords are really that complex.

As far as paranoia goes, the fact is that lots of damage is done to large networks by those on the inside. In a certain sense Kerberos is more secure than a firewall. In fact some Kerberos supported networks do not even have a firewall as it doesn't really add anything to the system.

 

A

Andy71600

Member

​

Joined

Apr 24, 2003

• Feb 29, 2004

• #10

all i have to say is "I'm Sorry" to the poor souls who have to know that password.

 

ashenfang

The Jet Man!

​

Joined

Feb 25, 2003

Location

Indiana

• Feb 29, 2004

• #11

so how exactly are you supposed to remember a 18k+ password

I wonder if thats ASCI or HEX

 

M

Malpine Walis

Disabled

Joined

Nov 23, 2001

Location

Banned Camp

• Feb 29, 2004

• #12

You do not need to remember it. Your computer needs to remember it. That is the bug that get fixed with the SP upgrade. And actually, your computer only needs to remember it until it expires. For the session key that is untill you log off. For the transaction key that is only untill the current request has been completed.

 

XWRed1

Senior Member

​

Joined

Oct 31, 2001

• Feb 29, 2004

• #13

Those aren't user passwords. Just kerberos tickets or keys. Alot less impressive or notworthy since it isn't a password.

 

M

Malpine Walis

Disabled

Joined

Nov 23, 2001

Location

Banned Camp

• Feb 29, 2004

• #14

Finally! someone who undersatnds Keberos! Thanks XWRed1. I have been going off of an article in Scientific American that I read a few years ago and I must be misremembering details.

Unfortunately, google does not seem to have a lot of info on the subject. How are tickets and keys different from passwords?

 

XWRed1

Senior Member

​

Joined

Oct 31, 2001

• Mar 1, 2004

• #15

I don't really know much about kerberos. But it's obvious that isn't a password a user is meant to remember. It was said it is for a computer to remember, which isn't that impressive cause that kind of stuff happens all the time.

Kerberos has some sort of ticket system to telling if you are allowed to use a resource. I can't sit here and tell you the anatomy of a ticket, but tickets and keys will be primarily different from a password because they are for the computers and not the users. The password is likely what generates or identifies a ticket/key, while the ticket or key is what flies over the wire.