|
![](/i/fill.gif) |
>> own custom-designed [and horribly weak] hash functions
>
> The only reason it was horribly weak is they fed the password in 7 or 8
> bytes at a time. So if you go the hash, you could brute-force a
> 14-character password by brute-forcing two 7-character passwords.
>
> That would be weak even if you were using DES to do the hashing.
The point being, they made a very simple and basic security mistake. If
they had used an established standard rather than trying to invent a
wheel from scratch themselves, this wouldn't have happened. (As I say,
they now use Kerberos, so there's some hope it works properly.)
Not the first time either. The world uses DNS, M$ invents WINS. What was
THAT about??
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |