 |
Unix systems keep the passwords to their accounts in a file in an encrypted
form -- but on many simple systems this file is publicly available. The
encryption on these passwords is virtually unbreakable. However, the
crack program (which is available on the internet and can be
run "in the background" for weeks on end on any Unix system) takes each encrypted
password and, using a special key (also provided with each password)
encrypts every word in an electronic dictionary, and compares them to the
encrypted password to see if they match. It also tries the words backwards,
with digits in front or behind, capitalized, as well as all the numbers
between, say, 1 and a million. It will use any dictionary supplied to it --
whatever the language.
This painstaking process can take a lot of time, but crack has
a lot of time, and eventually it will wind up with all the weak passwords on a
system.
Large systems like WAM and Glue no longer keep the vast
majority of their passwords in public files. This greatly increases their safety
from cracking (though not from intelligent guessing). But choosing a strong
password still makes sense.
|
