>>  own custom-designed [and horribly weak] hash functions 
> 
> The only reason it was horribly weak is they fed the password in 7 or 8 
> bytes at a time. So if you go the hash, you could brute-force a 
> 14-character password by brute-forcing two 7-character passwords.
> 
> That would be weak even if you were using DES to do the hashing.

The point being, they made a very simple and basic security mistake. If 
they had used an established standard rather than trying to invent a 
wheel from scratch themselves, this wouldn't have happened. (As I say, 
they now use Kerberos, so there's some hope it works properly.)

Not the first time either. The world uses DNS, M$ invents WINS. What was 
THAT about??

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message