Subject: RE: Isn't it a security hole...

From: Casper BodenCummins <[email-masked]>
Date: Fri, 16 Aug 1996 10:06:19 +0100

>>> If the max passwd
>>> length is 8 bytes, then at a quick estimate it seems that there are
>>> 256^8 * 4096 different possible passwords...?
>
Fewer than that. The range of ASCII characters used in passwords is
quite small: perhaps ~= 110, optimisticly taking into account control
characters and punctuation marks. Then, many people don't use the full 8
characters, so we have to reduce the _average_ number again. I'd
>tentatively suggest 6 characters.
>
>> If a password were a random sequence of characters, they would be nearly
>> unbreakable, but then people would have to write them down somewhere and
>> that is an even bigger security risk in many ways.

Perhaps, but I get by with random characters for some of my passwords.
It's tough to remember them, but you can't beat 'em. To invent them, I
type in strings of random characters until find one that feels
comfortable to type, and that's the one I learn.

>
>>                                       Brian
>>                              ( [email-masked] )
>
>>-----------------------------------------------------------------------
>>-------
>>   In theory, theory and practice are the same.  In practice, they're not.
>
Good point.

>Casper Boden-Cummins.

---

From: Rob Browning <[email-masked]>
Date: 16 Aug 1996 09:08:43 -0500

> >tentatively suggest 6 characters.

It's too bad we can't support longer passwords.  Not only are longer
ones easier to remember sometimes, but they are harder to break.
Something along the lines of the PGP passphrase.

I'm sure there's some historical, or backward compatibility reason why
we can't...

--
Rob

---

From: David C Winters <[email-masked]>
Date: Fri, 16 Aug 1996 13:11:24 -0400 (EDT)

> Something along the lines of the PGP passphrase.

	I've noticed something curious on various Unices:  I can have a 
27-character-long password any time I want.  For logins, though, login 
only cares about the first eight characters.  But to change the password, 
I have to enter the entire thing.
	I haven't tried this on Linux (yet); I'm talking more along the 
lines of SunOS, Solaris 2.x, maybe AIX 3.x.

> I'm sure there's some historical, or backward compatibility reason why

	Sure, that's probably the reason.  The cult of "backward
compatibility" IS, after all, responsible for far more heinous crimes, 
such as DOS' longevity...

David [email-masked] aka [email-masked]
Office: 3503 WeH, x86720
Go to http://www.harrybrowne96.org/
MTFBWY