Password security - Another idea

[Marc Teitelbaum]

In article <4546 at xenna.Encore.COM> bzs at Encore.COM (Barry Shein) writes:
>
>Round and round, and you're not disturbed at the fact that you're now
>...

The first problem I have with your argument is essentially this.  You
assume that file system security is weak enough that an average
hacker can gain access to the shadow password file.  I contend that
if the average hacker can accomplish this, then he doesn't *need*
to crack any passwords because he can *just* as easily gain access
to any other file in the filesystem.  And, after all, isn't that
what the hacker is after anyway.  Most of the interesting information
is contained in *files*, isn't it.  Then, if the average hacker is so 
facile at finding and gaining access to random files (shadow password
or otherwise), who the hell needs to crack passwords.

The second problem with your argument is that you overlook Henry's
point that no security is perfect, just that the more secure
system makes it that much *harder* to break in.  Puts up more road
blocks.  Leaves more trails for the careless. - Your argument is
that the perceived security of shadow password files will make the
system administrator more complacent, therefore it's undesireable.
Poppy cock.  That's a system administrator issue, and educating a
system administrator is a heck of a lot easier than educating the
entire user community.  I could just as easily argue that since
the file system protection is so insecure (to the point that any
hacker can access the shadow password file), then setting file
permissions is really a waste of time and just a delusion that your
files are secure.  Therefore, you're fooling yourself if you have
your umask set to anything other than 000.  I don't buy this - do you?

Marc

-------------------------------
Marc Teitelbaum			+1-415-643-6448
457 Evans Hall
Computer Systems Research Group,  CSRG / DEC
University of California
Berkeley, CA 94720