IDS Forum

RE: Workaround to get 952 when password in 10.00.F

Posted By: Jonathan Smaby
Date: Wednesday, 18 March 2009, at 12:41 p.m.

In Response To: Workaround to get 952 when password in 10.00.FC9 (LYNKZ MIKE)

> The main idea is let the users when they input wrong password.

Oh lordy, this is a very bad idea! There is value in the -951
non-descript authentication failure message. Reason being: hackers
using dictionary attacks against your DB server. If you return a
message that indicates only a wrong password, you give a HUGE advantage
to hackers, data-thieves, and the like. If they know they have a
correct Login ID, but just the wrong password, they will break into your
system much faster.

I know this, I've had database servers that have been successfully
hacked years ago. NOT a good thing.

I would suggest only giving that specific of an authentication failure
message (-951).

Just my 2-cents.

Jonathan B. Smaby
Pomona College
Administrative Information Systems Office
on-campus extension: x18506
phone: (909) 621-8506
email: jonathan.smaby@pomona.edu

-----Original Message-----
From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of
LYNKZ MIKE
Sent: Wednesday, March 18, 2009 9:09 AM
To: ids@iiug.org
Subject: Workaround to get 952 when password in 10.00.FC9 [15211]

Hi everyone, i contacted IBM for a fix or a tunable solution to get
error cod
952 when password is wrong, they said no to this, saying that its a
improvement that they did, and they dont see the need to get back the
change,
this is not a solution for us. Actually we think they could do a tunable

solution, like its a paremeter to let users create database they could
do a
solution for this.

Currently im thinking what we can do to let users know when they input
their
password wrong. I was reading about PAM and LDAP, but i think a big
change for
our production. Do you have any idea, a workaround we could do for
this??

The main idea is let the users when they input wrong password.

Thanks in advanced.

************************************************************************
*******
Forum Note: Use "Reply" to post a response in the discussion forum.

-------------------------------------------------------------
This message has been scanned by Postini anti-virus software.

Messages In This Thread

• Workaround to get 952 when password in 10.00.FC9
  LYNKZ MIKE -- Wednesday, 18 March 2009, at 12:08 p.m.
  • RE: Workaround to get 952 when password in 10.00.F
    Jonathan Smaby -- Wednesday, 18 March 2009, at 12:41 p.m.
  • Re: Workaround to get 952 when password in 10.00.F
    Art Kagel -- Wednesday, 18 March 2009, at 3:42 p.m.
    • Re: Workaround to get 952 when password in 10.00.F
      LYNKZ MIKE -- Wednesday, 18 March 2009, at 4:34 p.m.
      • Re: Workaround to get 952 when password in 10.00.F
        Art Kagel -- Wednesday, 18 March 2009, at 6:03 p.m.
        • Re: Workaround to get 952 when password in 10.00.F
          LYNKZ MIKE -- Wednesday, 18 March 2009, at 6:15 p.m.
          • Re: Workaround to get 952 when password in 10.00.F
            LYNKZ MIKE -- Wednesday, 18 March 2009, at 6:21 p.m.
            • RE: Workaround to get 952 when password in 10.00.F
              Jonathan Smaby -- Wednesday, 18 March 2009, at 6:50 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.