How many people actualy check for case when authenticating their users? I see that as one of the first steps to securing your pages.
No point making a random password and not checking for case Regards Steve Onnis Domain Concept Designs +61 422 337 685 +61 3 9444 7504 http://www.domainconceptdesigns.com <http://www.domainconceptdesigns.com> ("If you think it can't be done, you haven't asked me!") - Steve Onnis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Mark Stanton Sent: Monday, February 24, 2003 4:32 PM To: CFAussie Mailing List Subject: [cfaussie] RE: Dictionary attacks Might sound bloody obvious but - don't use dictionary words in your passwords, don't even use 1337ified dictionary words. If you use random 8 character combinations of upper & lower case alpha, numerals & punctuation a dictionary attack is going to cause a bit of load on the server & some unwanted bandwidth. At worst you are looking at a DOS style attack. Another very easy but not so secure option is listfirst(createUUID,'-'). Still much better than a dictionary word. I'm assuming that if the info on your page is serious enough to warrant concern about dictionary attacks the users would be willing to use whatever password they are given. Eg. I'm quite happy that my online banking insists I pick a good password. I've got a site that requires a username and password that is either selected by the user or their company administrator. From what I can see at least 80% of passwords are based on some part of their name, job title, company name or a word that appears on the login screen like 'welcome', 'login' or 'password'. In this case it doesn't really matter as there are no serious security risks in the site's functionality and ease of use is the bigger issue, but if there was confidential info on the site this type of freedom with passwords would be a major headache. Password Type 10^6 (millions of combinations) --------------------- ---------- english language words * 0.65 6 random alpha characters (not case sensitive) 308.92 8 characters from the start of a UUID (not case sensitive) 4294.97 8 random alpha characters (not case sensitive) 208827.06 8 random alpha characters (case sensitive) 53459728.53 8 random alpha, numeric & punct. chars (case sensitive) 806460091.89 * according to http://hypertextbook.com/facts/2001/JohnnyLing.shtml - although the average person only knows 20,000 words. Cheers Mark ______________ Mark Stanton Web Production Gruden Pty Ltd Tel: 9956 6388 Mob: 0410 458 201 Fax: 9956 8433 www.gruden.com --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/ --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
