Re: [Full-disclosure] What the f*** is going on?

[jf <jf@xxxxxxxxx>]

> this is only true for remote attackers hitting network service auth.

Mhmm, and runas, su et al couldn't benefit from this?
 
> better to assume they've got your hashes and you're racing the
> rainbows, dicts, and CUDAs for longevity...

Not that assuming you're popped/gonna get popped and acting accordingly is a 
horrible idea, but to make sure I'm understanding your debating points 
correctly; you're arguing that the reason you want complex passwords is to slow 
the rainbow tab les once an attacker has write access to lsass, read access to 
shadow, popped the pdc, et cetera?
 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/