Anurag,
You're right that a space character shouldn't make a difference if they are
using any respectable hashing algorithm. But since we're talking about real
applications, you can't assume they will use a well-known hashing algorithm,
or even perform hashing at all. People make unfortunate decisions all the
time when it comes to password systems. Remember the Unix 8 character
password limitation? Remember Windows LM hashing?
The ISACA (www.isaca.org) Web site wants you to use letters and numbers in
your account password. What about letters and symbols? There are actually
more symbols, so they should make a better pool to choose from than numbers.
Nope, the application doesn't accept it; you must have letters and numbers.
And this is a computer security organization.
I can't say for sure what symbols people actually try, but spaces,
underscores, and dashes aren't the most popular choices for users.
----
Bruce K. Marshall - bkmarshall@passwordresearch.com
Password Research Institute - http://www.passwordresearch.com
----- Original Message -----
From: "Anurag Joshi" <mastermindanu@gmail.com>
To: <pen-test@securityfocus.com>
Sent: Thursday, September 08, 2005 9:46 PM
Subject: Re: Whitespace in passwords
List,
With due respect i dont think whitespaces would make any
difference. It just depends on the encrypting algo. In all cases
whitespace amounts to a ASCII code and hence a binary representation, thus
encrypting or decrypting would make no difference. If the algo has no no
rule for whitespaces then it is not allowed. But when it comes to symbols
whitespaces, underscores, dash are probably the first ones anyone will
look for.
Anurag Joshi
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
