Re: What the f*** is going on?

[jf <jf () ownco net>]

> this is only true for remote attackers hitting network service auth.

Mhmm, and runas, su et al couldn't benefit from this?
 
> better to assume they've got your hashes and you're racing the
> rainbows, dicts, and CUDAs for longevity...

Not that assuming you're popped/gonna get popped and acting accordingly is a horrible idea, but to make sure I'm 
understanding your debating points correctly; you're arguing that the reason you want complex passwords is to slow the 
rainbow tab les once an attacker has write access to lsass, read access to shadow, popped the pdc, et cetera?
 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/