Jeffrey Walton <[email protected]> writes: >One general comment that does not fit well into most of the discussions around >sshole...
Another contributing factor, "sshd borrows bob's salt" and the derived changes, was the quaint 1970s notion that no-one would ever be able to guess that there exist account names like root, daemon, ldap, postfix, apache, mysql, sshd, and rumpelstiltskin, so we'll add a kludge to make invalid accounts take the same time as valid ones. Attackers don't even notice this because they start with a pregenerated list of known and probable accounts, but it does help to add vulnerabilities to the password-checking process as this CVE shows. Peter.
