[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120418214611.GA28500@debian>
Date: Thu, 19 Apr 2012 01:46:11 +0400
From: Aleksey Cherepanov <aleksey.4erepanov@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: identifying patterns to successfully crack more
passwords
On Sun, Apr 15, 2012 at 10:32:59PM +0200, Frank Dittrich wrote:
> > During contest search of patterns was very valuable.
>
> Yes. Did you think about ways to make that easier, e.g., detect patterns
> automatically, and decide in which sequence to try those patterns
> on the remaining password hashes?
>
> What if you detect patterns in cracked passwords submitted by other
> users, and after trying to find more passwords with the same patterns
> you realize there are no more such passwords because the user already
> tried all password candidates for these patterns?
> You'll have wasted time due to duplicated effort.
> Can you think of ways how to prevent this (more or less automatically
> instead of manually)?
My general idea is to not allow users to crack passwords on their own: instead
they should upload attack description (suitable for dispatching), and then the
system will dispatch attack and mark it as finished. So we would not waste
time on reverse engineering of work some user already did.
Also having control over the main road of attacks we could avoid useless
attacks: to avoid bottlenecks like too busy leader and to make such
restriction more enjoyable checks and review will be done by other users using
votes. Votes could either make priority of attack higher or make closer to the
top of a list for review by leader (or leaders) before dispatching (if we have
such review).
In addition to votes there could be modification proposals: it should be
something like new attack description but connected with this showing that it
replaces old one.
And as a natural addition I see partial attack descriptions: for instance
someone found a pattern but do not know how to write rules for that - he
writes regex or picks pattern by hands and commits it, then someone other
upgrades such description to full (while it is regex only incremental mode
could be applied).
Regards,
Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
