depends on the app - or more accurately on the client. I prefer case sensitivity for the most part, but a lot of clients insist on the reverse, especially in cms and internal systems as they don't want to spend any time supporting or educating their staff.
Toby Monday, February 24, 2003, 4:46:30 PM, you wrote: SO> How many people actualy check for case when authenticating their users? SO> I see that as one of the first steps to securing your pages. SO> No point making a random password and not checking for case SO> Regards SO> Steve Onnis SO> Domain Concept Designs SO> +61 422 337 685 SO> +61 3 9444 7504 SO> http://www.domainconceptdesigns.com <http://www.domainconceptdesigns.com> SO> ("If you think it can't be done, you haven't asked me!") - Steve Onnis SO> -----Original Message----- SO> From: [EMAIL PROTECTED] SO> [mailto:[EMAIL PROTECTED] Behalf Of Mark SO> Stanton SO> Sent: Monday, February 24, 2003 4:32 PM SO> To: CFAussie Mailing List SO> Subject: [cfaussie] RE: Dictionary attacks SO> Might sound bloody obvious but - don't use dictionary words in your SO> passwords, don't even use 1337ified dictionary words. SO> If you use random 8 character combinations of upper & lower case alpha, SO> numerals & punctuation a dictionary attack is going to cause a bit of load SO> on the server & some unwanted bandwidth. At worst you are looking at a DOS SO> style attack. SO> Another very easy but not so secure option is listfirst(createUUID,'-'). SO> Still much better than a dictionary word. SO> I'm assuming that if the info on your page is serious enough to warrant SO> concern about dictionary attacks the users would be willing to use whatever SO> password they are given. Eg. I'm quite happy that my online banking insists SO> I pick a good password. SO> I've got a site that requires a username and password that is either SO> selected by the user or their company administrator. From what I can see at SO> least 80% of passwords are based on some part of their name, job title, SO> company name or a word that appears on the login screen like 'welcome', SO> 'login' or 'password'. In this case it doesn't really matter as there are no SO> serious security risks in the site's functionality and ease of use is the SO> bigger issue, but if there was confidential info on the site this type of SO> freedom with passwords would be a major headache. SO> Password Type 10^6 (millions of SO> combinations) SO> --------------------- ---------- SO> english language words * 0.65 SO> 6 random alpha characters (not case sensitive) 308.92 SO> 8 characters from the start of a UUID (not case sensitive) 4294.97 SO> 8 random alpha characters (not case sensitive) 208827.06 SO> 8 random alpha characters (case sensitive) 53459728.53 SO> 8 random alpha, numeric & punct. chars (case sensitive) 806460091.89 SO> * according to http://hypertextbook.com/facts/2001/JohnnyLing.shtml - SO> although the average person only knows 20,000 words. SO> Cheers SO> Mark SO> ______________ SO> Mark Stanton SO> Web Production SO> Gruden Pty Ltd SO> Tel: 9956 6388 SO> Mob: 0410 458 201 SO> Fax: 9956 8433 SO> www.gruden.com SO> --- SO> You are currently subscribed to cfaussie as: [EMAIL PROTECTED] SO> To unsubscribe send a blank email to [EMAIL PROTECTED] SO> MX Downunder AsiaPac DevCon - http://mxdu.com/ SO> --- SO> You are currently subscribed to cfaussie as: [EMAIL PROTECTED] SO> To unsubscribe send a blank email to [EMAIL PROTECTED] SO> MX Downunder AsiaPac DevCon - http://mxdu.com/ --------------------------------------- Life is poetry - write it in your own words. --------------------------------------- Toby Tremayne Technical Team Lead Code Poet and Zen Master of the Heavy Sleep Toll Solutions 154 Moray St Sth Melbourne VIC 3205 +61 3 9697 2317 0416 048 090 ICQ: 13107913 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
