User: Password:
|
|
Subscribe / Log in / New account

Responsible disclosure in open source: The crypt() vulnerability

Responsible disclosure in open source: The crypt() vulnerability

Posted Jun 9, 2012 18:14 UTC (Sat) by halfline (subscriber, #31920)
Parent article: Responsible disclosure in open source: The crypt() vulnerability

DES crypt() should already be considered insecure and a bad idea to use.

For instance, the algorithm treats all passwords greater than 8 characters to be equivalent to the first 8 character prefix of those passwords. (the password "password" is equivalent to the password "password hashing is hard")

It's documented to only look at the lower 7bits of each character as well, so "ůh?" is equivalent to "Eh?", I believe, etc


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds