response 139 of 222:

Jun 8 00:49 UTC 2000

My impression is that by default most but not all Unix systems use the same
hashing algorythm.  There's a good standardization argument for that, since
it allows password files to be moved between systems, but I suspect it has
more to do with people creating new Unix systems tending to reuse stuff from
older systems.

However, there is nothing stopping somebody from writing their own crypt()
function.  Some systems are different from others, by default.  Grex has its
own password encryption function that Marcus wrote, in order to be less useful
to somebody trying to run crack on stuff here.

response 141 of 222:

Jun 8 03:43 UTC 2000

Most Unix systems use crypt, which is derived from DES.  Most systems
don't meddle with it, because creating good encryption algorithms is a
very subtle and sophisticated art.  In many, many cases if you try to
make "improvements" you may be weakening it instead.  So most people are
well advised not to fiddle with these things.

Grex has been through no less than three password encryption algorithms.

The original one was the standard Unix one, which takes the first eight
characters of your password, and converts them into a 14 character
gobbilty gook string (of which only 12 characters really count).

When we switched over to the shadow password system, we also started
using the "encrypt" password encryption algorithm that came with that. 
This wanted to use more than eight characters of your password, so it
encrypted the first eight, and then the second eight with the old crypt
algorithm, giving two 12 character strings, and stored them both.

That's better, right?  Wrong.  In practice, if people's password is
longer than eight characters, it is usually only a few characters long. 
So the second crypt is usually an encryption of strings only a few
characters long - hence easy to crack.  Knowing the last few letters of
someone's password actually makes guessing the first eight easier.  So
the net effect of this "improved" algorithm is that it is weaker than
the original.

Marcus replaced that with his own algorithm, which also uses more than
the first eight letters, but does it much more intelligently.  It's
based on a well-established encryption algorithm called SHA.

If you want to know everything there is to know about how Grex encrypts
and stores passwords, see
    http://www.cyberspace.org/staffnote/passwd.html

I've seen some talk about Linux systems using MD5 password encryption,
and various other Unix versions have used various other password
encryption techniques.

response 143 of 222:

Jun 9 00:54 UTC 2000

I had no trouble getting grex to accept a password from a language that has
dictionaries (in transcription) and another account accepted a password from
another language that uses the Latin alphabet.  I don't see why grex should
scan every language of Europe into its password computer.  Grex might,
however, want to prevent people from using passwords with an obvious relation
to logins.  Is there some program to prevent this?

It is taking much longer than usual for the login script to appear when I dial
in, or maybe it only seems that way because there is no wait message.

response 145 of 222:

Jun 9 02:08 UTC 2000

passwd does check for passwords that bear an "obvious" relationship to
the loginid.  When I was collecting word lists out on the web, I didn't
succeed in finding a word list for every european language, nor every
language that can be transcribed using the latin alphabet.  I do see in
checking that I actually do have a much better word list that somehow
never made it onto grex.  Perhaps I'll do so in due course (my best
collection of words does include japanese & some swahili, among other
things.)

response 147 of 222:

Jun 9 04:55 UTC 2000

Any password that is a 'word' as spelled in a dictionary
in any language is a bad password as crack can be used
to crack it.  Years ago when I ran against a large unix
password file it cracked about 25% with just an english
dictionary.  When I added spanish, french, german, russian,
and a 'jargon/technical' dictionary the crack rate was close
to doubled.

response 149 of 222:

Jun 9 09:52 UTC 2000

(perhaps a separate item discussing the pitfalls of
any password that is a 'word'?)

response 151 of 222:

Jun 9 14:46 UTC 2000

Grex accepted a common Bulgarian word (in BGN transcription).   I have not
tried it yet on Albanian or Latvian or Finnish or even Romanian.  How long
would it take someone to find my password if they were told it was in a
language of Europe, even one that does not need to be transliterated?
English, German, Dutch, Swedish, Norwegian, Danish, Icelandic, French, Basque,
Romansh (sp?), Portuguese, Spanish, Italian, Romanian, ten Slavic languages,
Finnish, Hungarian, Latvian, Lithuanian, Latin, modern and ancient Greek,
Albanian, Turkish, Welsh, Scots Gaelic, Irish Gaelic - and let's not forget
every possible verbal ending (I used a verb with an ending in some other
account) and plurals and adjective endings.    Grex does accept combinations
of English words with numbers.  Like tpryan says, if you only give someone
5 guesses, there is no need to worry about other languages.

response 153 of 222:

Jun 9 16:09 UTC 2000

WHat he said.  If you care about the security of your account, do not use
words in other languages.

response 155 of 222:

Jun 9 17:39 UTC 2000

They don't necessarily care about you personally.  They may just want an
account to work from so some other sucker gets the blame for what they're
doing.  They'd use other dictionaries simply because more dictionaries will
bag them more passwords.

As for whether they could read your email if they wanted to, keep in mind that
the US does not have a monopoly on computer access or skills.  The intruder
who hits you might be a native speaker of whatever language your email is in.
There are a heck of a lot of Russian script-kiddies out there, and there are
even some working out of other slavic-speaking countries as well.

response 157 of 222:

Jun 9 19:31 UTC 2000

 re 154  There are things called scanners which can enter dictionaries without
too much effort.

response 159 of 222:

Jun 9 23:57 UTC 2000

Most vandals would not care about keesan in particular.  They would
merely be trying the largest collection of words they can acquire
against what they hope are the hashed passwords from grex.  If they
acquire the password to a real account, they hope to be able to log in,
read through your e-mail to see where else you might have an account, or
who your friends are, and they may then try to leverage your access to
also gain access themselves to that machine.  This is, in fact, how
gryps was initially compromised - a site elsewhere was compromised, a
grex staff member happened to have access at that site, and the vandal
discovered the grex staff person's password was the same on gryps.
Obviously, this is now fixed, but this is a good illustration of the
line of attack many vandals pursue.

response 161 of 222:

Jun 10 02:13 UTC 2000

(1) yes.  (2) don't use a system that would be obvious to a vandal.  Ie,
"this is my grex password" would probably pass the grex password test,
but a vandal might well guess that your nether.net password is something
along the lines of "this is my nether.net password".